EXPOSURES › CVE-2021-44228

CVE-2021-44228

CRITICAL ⌖ ON CISA KEV · EXPLOITED

DETAIL

SourceCISA-KEV · kev Published2021-12-10 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2021-44228 ↗

⚡ RCE ◐ ZERO-DAY ⌖ EXPLOITED IN THE WILD SHAME 95/100 ransomwarerceexploited-in-wild

The Log4j2 vulnerability allowed attackers to execute arbitrary code on vulnerable systems remotely.

▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

PLAYERS IMPLICATED

apache · vendor Log4j2 · product

DESCRIPTION

Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.

AFFECTED FEDRAMP PRODUCTS · 10

PRODUCT	PROVIDER	STATUS	MATCH
Cisco Cloudlock for Government Cisco Systems Inc.	Cisco Systems Inc.	Authorized	vendor-exact · 0.90
Cisco Meraki for Government Cisco Systems Inc.	Cisco Systems Inc.	In Process	vendor-exact · 0.90
Cisco SD-WAN for Government Cisco Systems Inc.	Cisco Systems Inc.	In Process	vendor-exact · 0.90
Cisco Umbrella for Government Cisco Systems Inc.	Cisco Systems Inc.	In Process	vendor-exact · 0.90
Cisco Unified Communications Manager Cloud for Government (Cisco UCM Cloud for Government) Cisco Systems Inc.	Cisco Systems Inc.	Authorized	vendor-exact · 0.90
Cloud Insights NetApp	NetApp	In Process	vendor-exact · 0.90
Duo Federal Duo Security (A Cisco Company)	Duo Security (A Cisco Company)	Authorized	dex-judge · 0.95
Mendix Cloud for Government Siemens Government Technologies	Siemens Government Technologies	In Process	vendor-exact · 0.90
WebEx Contact Center Enterprise for Government (WxCCE-G) Cisco Systems Inc.	Cisco Systems Inc.	In Process	vendor-exact · 0.90
Webex for Government Cisco Systems Inc.	Cisco Systems Inc.	Authorized	vendor-exact · 0.90