WaratekVRT Sign in

CVE-2022-23305 Apache Log4j

Affected softwareApache Log4j
Severity9.8 Critical CVSS 3.1 3 scores
WeaknessSQL injection (CWE-89)
Published18 Jan 2022
Updated13 Nov 2026

Description

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

Exploitation status

Proof of concept only

A proof of concept exists, but no reviewed exploit catalogue lists this CVE.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC 3 indexed Published artifacts you can open, in GitHub PoC; first seen 2021-12-14.
  • EPSS 67% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99% of all scored CVEs.

1 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC Fastest filesystem scanner for log4shell (CVE-2021-44228, CVE-2021-45046) and other vulnerable (CVE-2017-5645, CVE-2019-17571, CVE-2022-23305, CVE-2022-23307 ... ) instances of log4j library. Excellent performance and low memory footprint. 39 2021-12-14
GitHub PoC test 反向辣鸡数据投放 CVE-2022-23305 工具 利用 教程 Exploit POC 5 2022-01-21
GitHub PoC CVE-2022-23305 Log4J JDBCAppender SQl injection POC 1 2023-07-24

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

Decided by A researcher's recorded decision for this specific CVE
Finding A researcher found this CVE protected by the ARMR SQLI rule.

Waratek research note

written 2026-11-13

Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.

Comments

Rule Name: SQLI rule

How to mitigate CVE-2022-23305

Apply the vendor's fix for Apache Log4j. Until you can, Waratek RASP blocks exploitation with its SQL injection rule. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

9.8 CRITICAL v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 3 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CISA-ADP Secondary
CVSS 2.0 6.8 none AV:N/AC:M/Au:N/C:P/I:P/A:P NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Security Patch Update August 2026 ↗ CSPU 2026-Q3 Oracle Hyperion / Security (Apache Log4j) (11.2.25.0.000)
Oracle Critical Patch Update April 2026 ↗ CPU 2026-Q2 Oracle Siebel CRM / Server Infrastructure (Apache Log4j) (17.0-25.11)
Oracle Critical Patch Update October 2024 ↗ CPU 2024-Q4 Oracle Analytics / BI Application Archive (Apache Log4j) (7.0.0.0.0)
Oracle Critical Patch Update July 2023 ↗ CPU 2023-Q3 Oracle Enterprise Manager / Load Testing for Web Apps (Apache Log4j) (13.3.0.1)
Oracle Critical Patch Update April 2023 ↗ CPU 2023-Q2 Oracle Utilities Applications / General (Apache Log4j) (4.2.0.3.0)
Oracle Critical Patch Update January 2023 ↗ CPU 2023-Q1 Oracle Fusion Middleware / Core (Apache Log4j) (14.1.1.0.0)
Oracle Critical Patch Update October 2022 ↗ CPU 2022-Q4 Oracle E-Business Suite / EBS EM Plugin (Apache Log4j) (13.4.1.0.0)
Oracle's note: Please refer support Doc ID 2858304.1 for the patch.
Oracle Fusion Middleware / Third Party Patch (Apache Log4j) (12.2.1.3.0)
Oracle Fusion Middleware / Web Content Management (Apache Log4j) (12.2.1.3.0)
Oracle Retail Applications / Others (Apache Log4j) (14.2)
Oracle Supply Chain / Installation Issues (Apache Log4j) (6.2.1.0)
Oracle Critical Patch Update July 2022 ↗ CPU 2022-Q3 Oracle Communications Applications / Charging Server (Apache Log4j) (Prior to 12.0.0.4.4, Prior to 12.0.0.5.1)
Oracle Communications Applications / XMPP Server (Apache Log4j) (10.0.1.5.0)
Oracle E-Business Suite / Packaging issues (Apache Log4j) (12.2.3-12.2.11)
Oracle Retail Applications / Mathematical Operators (Apache Log4j) (13.2.5)
Oracle Critical Patch Update April 2022 ↗ CPU 2022-Q2 Oracle Communications / Core (Apache Log4j) (4.5)
Oracle Communications Applications / Cartridge Deployer Tool (Apache Log4j) (7.3.6)
Oracle Communications Applications / ISC (Apache Log4j) (8.1)
Oracle Communications Applications / Logging (Apache Log4j) (7.3.4-7.3.5, 7.4.1-7.4.2)
Oracle E-Business Suite / Logging (Apache Log4j) (EBS Cloud Manager and Backup Module: Prior to 22.1.1.1)
Oracle Enterprise Manager / Oracle Management Service (Apache Log4j) (13.4.0.0, 13.5.0.0)
Oracle Financial Services Applications / Infrastructure (Apache Log4j) (2.7.0.0, 2.7.0.1, 2.8.0.0)
Oracle Fusion Middleware / Analytics Server (Apache Log4j) (5.9.0.0.0)
Oracle Fusion Middleware / BI Platform Security (Apache Log4j) (5.9.0.0.0, 12.2.1.3.0, 12.2.1.4.0)
Oracle Fusion Middleware / Centralized Third Party Jars (Apache Log4j) (12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0)
Oracle Fusion Middleware / General and Misc (Apache Log4j) (-)
Oracle's note: Oracle Application Development Framework (ADF) is downloaded via Oracle JDeveloper Product. Please refer to Fusion Middleware Patch Advisor for more details.
Oracle Fusion Middleware / Installer (Apache Log4j) (12.2.1.3.0, 12.2.1.4.0)
Oracle Fusion Middleware / Oracle JDeveloper (Apache Log4j) (12.2.1.3.0)
Oracle Fusion Middleware / Runtime Engine (JBoss Enterprise Application Platform) (12.2.1.3.0, 12.2.1.4.0)
Oracle Fusion Middleware / Storage Service Integration (Apache Log4j) (12.2.1.4.0)
Oracle Fusion Middleware / Third Party Patch (Apache Log4j) (12.2.1.4.0)
Oracle Fusion Middleware / Third Party Patch (Apache Log4j) (12.2.2.0.0)
Oracle HealthCare Applications / FHIR (Apache Log4j) (8.1.0)
Oracle Hyperion / Installation and Configuration (Apache Log4j) (Prior to 11.2.8.0)
Oracle Hyperion / Installation/Configuration (Apache Log4j) (Prior to 11.2.8.0)
Oracle MySQL / Monitoring: General (Apache Log4j) (8.0.29 and prior)
Oracle Supply Chain / MscObieeSrvlt (Apache Log4j) (12.1, 12.2)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Analytics BI Application Archive (Apache Log4j) 7.0.0.0.0 7.0.0.0.0
Oracle Communications Core (Apache Log4j) 4.5 4.5
Oracle Communications Applications Cartridge Deployer Tool (Apache Log4j) 7.3.6 7.3.6
Oracle Communications Applications Charging Server (Apache Log4j) Prior to 12.0.0.4.4, Prior to 12.0.0.5.1
Oracle Communications Applications ISC (Apache Log4j) 8.1 8.1
Oracle Communications Applications Logging (Apache Log4j) 7.3.4-7.3.5, 7.4.1-7.4.2
Oracle Communications Applications XMPP Server (Apache Log4j) 10.0.1.5.0 10.0.1.5.0
Oracle E-Business Suite EBS EM Plugin (Apache Log4j) 13.4.1.0.0 13.4.1.0.0
Oracle E-Business Suite Logging (Apache Log4j) EBS Cloud Manager and Backup Module: Prior to 22.1.1.1
Oracle E-Business Suite Packaging issues (Apache Log4j) 12.2.3-12.2.11
Oracle Enterprise Manager Load Testing for Web Apps (Apache Log4j) 13.3.0.1 13.3.0.1
Oracle Enterprise Manager Oracle Management Service (Apache Log4j) 13.4.0.0, 13.5.0.0 13.4.0.0 · 13.5.0.0
Oracle Financial Services Applications Infrastructure (Apache Log4j) 2.7.0.0, 2.7.0.1, 2.8.0.0 2.7.0.0 · 2.7.0.1 · 2.8.0.0
Oracle Fusion Middleware Analytics Server (Apache Log4j) 5.9.0.0.0 5.9.0.0.0
Oracle Fusion Middleware BI Platform Security (Apache Log4j) 5.9.0.0.0, 12.2.1.3.0, 12.2.1.4.0 5.9.0.0.0 · 12.2.1.3.0 · 12.2.1.4.0
Oracle Fusion Middleware Centralized Third Party Jars (Apache Log4j) 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0
Oracle Fusion Middleware Core (Apache Log4j) 14.1.1.0.0 14.1.1.0.0
Oracle Fusion Middleware General and Misc (Apache Log4j) -
Oracle Fusion Middleware Installer (Apache Log4j) 12.2.1.3.0, 12.2.1.4.0 12.2.1.3.0 · 12.2.1.4.0
Oracle Fusion Middleware Oracle JDeveloper (Apache Log4j) 12.2.1.3.0 12.2.1.3.0
Oracle Fusion Middleware Runtime Engine (JBoss Enterprise Application Platform) 12.2.1.3.0, 12.2.1.4.0 12.2.1.3.0 · 12.2.1.4.0
Oracle Fusion Middleware Storage Service Integration (Apache Log4j) 12.2.1.4.0 12.2.1.4.0
Oracle Fusion Middleware Third Party Patch (Apache Log4j) 12.2.1.3.0 12.2.1.3.0 · 12.2.1.4.0 · 12.2.2.0.0
Oracle Fusion Middleware Web Content Management (Apache Log4j) 12.2.1.3.0 12.2.1.3.0
Oracle HealthCare Applications FHIR (Apache Log4j) 8.1.0 8.1.0
Oracle Hyperion Installation and Configuration (Apache Log4j) Prior to 11.2.8.0
Oracle Hyperion Installation/Configuration (Apache Log4j) Prior to 11.2.8.0
Oracle Hyperion Security (Apache Log4j) 11.2.25.0.000 11.2.25.0.0
Oracle MySQL Monitoring: General (Apache Log4j) 8.0.29 and prior
Oracle Retail Applications Mathematical Operators (Apache Log4j) 13.2.5 13.2.5
Oracle Retail Applications Others (Apache Log4j) 14.2 14.2
Oracle Siebel CRM Server Infrastructure (Apache Log4j) 17.0-25.11
Oracle Supply Chain Installation Issues (Apache Log4j) 6.2.1.0 6.2.1.0
Oracle Supply Chain MscObieeSrvlt (Apache Log4j) 12.1, 12.2 12.1 · 12.2
Oracle Utilities Applications General (Apache Log4j) 4.2.0.3.0 4.2.0.3.0

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
log4j:log4j 0 none 1.2.17
org.zenframework.z8.dependencies.commons:log4j-1.2.17 0 none 2.0

Products and versions

30 products, 43 version entries
SourceVendorProductSchemeAffected versions
nvd apache log4j generic ≥ 1.2 and ≤ 1.2.17
nvd broadcom brocade sannav generic any version
osv log4j log4j generic ≤ 1.2.17
nvd netapp snapmanager generic any version
nvd oracle advanced supply chain planning generic 12.1 · 12.2
nvd oracle business intelligence generic 5.9.0.0.0 · 12.2.1.3.0 · 12.2.1.4.0
nvd oracle business process management suite generic 12.2.1.3.0 · 12.2.1.4.0
nvd oracle communications eagle ftp table base retrieval generic 4.5
nvd oracle communications instant messaging server generic 10.0.1.5.0
nvd oracle communications messaging server generic 8.1
nvd oracle communications network integrity generic 7.3.6
nvd oracle communications offline mediation controller generic ＜ 12.0.0.4.4 · 12.0.0.5.0
nvd oracle communications unified inventory management generic 7.4.1 · 7.4.2
nvd oracle e-business suite cloud manager and cloud backup module generic 2.2.1.1.1 · ＜ 2.2.1.1.1
nvd oracle e-business suite information discovery generic ≥ 12.2.3 and ≤ 12.2.11
nvd oracle enterprise manager base platform generic 13.4.0.0 · 13.5.0.0
nvd oracle financial services revenue management and billing analytics generic 2.7.0.0 · 2.7.0.1 · 2.8.0.0
nvd oracle healthcare foundation generic 8.1.0
nvd oracle hyperion data relationship management generic ＜ 11.2.8.0
nvd oracle hyperion infrastructure technology generic ＜ 11.2.8.0
nvd oracle identity management suite generic 12.2.1.3.0 · 12.2.1.4.0
nvd oracle identity manager connector generic 11.1.1.5.0
nvd oracle jdeveloper generic 12.2.1.3.0
nvd oracle middleware common libraries and tools generic 12.2.1.4.0
nvd oracle mysql enterprise monitor generic ≤ 8.0.29
nvd oracle retail extract transform and load generic 13.2.5
nvd oracle tuxedo generic 12.2.2.0.0
nvd oracle weblogic server generic 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0
osv org.zenframework.z8.dependencies.commons log4j-1.2.17 generic ≤ 2.0
nvd qos reload4j generic ＜ 1.2.18.2

References

URLTags
https://github.com/apache/logging-log4j1 PACKAGE
https://lists.apache.org/thread/pt6lh3pbsvxqlwlp4c5l798dv2hkc85y WEB
https://logging.apache.org/log4j/1.2/index.html WEB
https://security.netapp.com/advisory/ntap-20220217-0007 WEB
https://www.oracle.com/security-alerts/cpuapr2022.html WEB
https://www.oracle.com/security-alerts/cpujul2022.html WEB
http://www.openwall.com/lists/oss-security/2022/01/18/4 WEB
https://security.netapp.com/advisory/ntap-20220217-0007/ Third Party Advisory

Timeline
Published2022-01-18By the CVE Program.
NVD record modified2026-06-17NVD's own last-modified date for this record.
Classification created2026-11-13First commit adding this CVE's research note.
Last VRT activity2026-11-13Most recent commit touching this CVE's classification, patch or rule file.