CVE-2019-17571

Published Dec 20, 2019

Last updated 10 days ago

Overview

Description
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.
Source
security@apache.org
NVD status
Modified
Products
log4j, debian_linux, ubuntu_linux, leap, oncommand_system_manager, oncommand_workflow_automation, application_testing_suite, communications_network_integrity, endeca_information_discovery_studio, financial_services_lending_and_leasing, mysql_enterprise_monitor, primavera_gateway, rapid_planning, retail_extract_transform_and_load, retail_service_backbone, weblogic_server, bookkeeper

Risk scores

CVSS 3.1

Type
Primary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

CVSS 2.0

Type
Primary
Base score
7.5
Impact score
6.4
Exploitability score
10
Vector string
AV:N/AC:L/Au:N/C:P/I:P/A:P

Weaknesses

security@apache.org
CWE-502
nvd@nist.gov
CWE-502
134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-502

Social media

Hype score
Not currently trending

Configurations

References

Sources include official advisories and independent security research.