What is the severity of CVE-2021-44832?

CVE-2021-44832 has a CVSS v3 score of 6.6, which is classified as Medium severity.

Is there an exploit available for CVE-2021-44832?

Yes, there are known exploits available for CVE-2021-44832. Immediate patching is recommended.

Is there a patch available for CVE-2021-44832?

Yes, patches are available for CVE-2021-44832. Check the vendor advisories for update instructions.

Agentic AI · Pentesting

Ready for Agentic Automated Testing?

Deploy autonomous AI agents that reason, exploit, and validate complex vulnerability chains — not another scanner, an agentic system that thinks like a senior pentester.

Zero false positives

PoC for every finding

30+ tools orchestrated

Book a Demo Learn More

Setup in 5 minutesSOC 2 & ISO 27001

CVE-2021-44832 - CVE Details, Severity, and Analysis | Strobes VI

Severity Scores

CVSS v36.6

CVSS v28.5

Priority Score400.0

EPSS Score54.0

Medium

Exploitation LikelihoodCritical

54.00%EPSS

Very high probability of exploitation in the next 30 days

Immediate patching required

54.00%

EPSS

6.6

CVSS

Yes

Exploit

Yes

Patch

High Priority

high EPSS • exploit exists

EPSS predicts the probability of exploitation in the next 30 days based on real-world threat data, complementing CVSS severity scores with actual risk assessment.

Description

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to an attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.

Affected packages

Only the org.apache.logging.log4j:log4j-core package is directly affected by this vulnerability. The org.apache.logging.log4j:log4j-api should be kept at the same version as the org.apache.logging.log4j:log4j-core package to ensure compatability if in use.

This issue does not impact default configurations of Log4j2 and requires an attacker to have control over the Log4j2 configuration, which reduces the likelihood of being exploited.

CVSS v3 Breakdown

Attack Vector:Network

Attack Complexity:High

Privileges Required:High

User Interaction:Network

Scope:Unchanged

Confidentiality:High

Integrity:High

Availability:High

Exploit References

GitHub GitHub Snort

Patch References

[email protected][email protected][email protected]

Trend Analysis

Neutral

Vulnerable Products

Vendor	Product
Apache	Log4j
Oracle