What is CVE-2021-45046?

CVE-2021-45046 is a critical-severity vulnerability in Apache Log4j, classified under Improper Neutralization of Special Elements used in an Expression Language Statement (Expression Language Injection). CVSS score: 9.0/10. Published 2021-12-14.

How severe is CVE-2021-45046?

Critical severity. CVSS v3 base score is 9.0 out of 10.

Is CVE-2021-45046 known to be exploited?

Yes. CVE-2021-45046 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2023-05-01), indicating it is being actively exploited. 348 public proof-of-concept repositories are indexed.

Log4Shell — Apache Log4j RCE

CVE-2021-45046

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configurati…

Vulnerability class: Log4Shell (CVE-2021-44228)

EPSS: 1.000 (100.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.0 (Critical). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H.

Affected products

Apache Log4j — versions 2.0
Apache Software Foundation Log4j — versions Apache Log4j2
Cvat Computer_vision_annotation_tool
Intel Audio_development_kit
Intel Datacenter_manager
Intel Genomics_kernel_library
Intel Oneapi
Intel Secure_device_onboard
Intel Sensor_solution_firmware_development_kit
Intel System_debugger

Weakness classification (CWE)

CWE-917 — Improper Neutralization of Special Elements used in an Expression Language Statement (Expression Language Injection)

CISA KEV (Known Exploited Vulnerabilities)

This CVE is on the CISA KEV catalog, added on 2023-05-01. CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.

BOD 22-01 due date: 2023-05-22.

Required action: Apply updates per vendor instructions.

Known ransomware campaign use: yes.

Public proof-of-concept exploits

References

security@apache.org (x_refsource_CONFIRM, Third Party Advisory)
security@apache.org (x_refsource_CONFIRM, Third Party Advisory)
security@apache.org (x_refsource_MISC, Not Applicable)
security@apache.org (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory, Mitigation)
security@apache.org (x_refsource_CONFIRM, Release Notes, Mitigation, Vendor Advisory)
security@apache.org (US Government Resource, x_refsource_CERT-VN, Third Party Advisory, third-party-advisory)
security@apache.org (x_refsource_CONFIRM, Third Party Advisory)
security@apache.org (x_refsource_CONFIRM, Third Party Advisory)
security@apache.org (x_refsource_CISCO, vendor-advisory, Third Party Advisory)
security@apache.org (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2021-45046?: CVE-2021-45046 is a critical-severity vulnerability in Apache Log4j, classified under Improper Neutralization of Special Elements used in an Expression Language Statement (Expression Language Injection). CVSS score: 9.0/10. Published 2021-12-14.
How severe is CVE-2021-45046?: Critical severity. CVSS v3 base score is 9.0 out of 10.
Is CVE-2021-45046 known to be exploited?: Yes. CVE-2021-45046 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2023-05-01), indicating it is being actively exploited. 348 public proof-of-concept repositories are indexed.