Lucene search
China National Vulnerability DatabaseCNVD-2022-08370HistoryJan 20, 2022 - 12:00 a.m.
Apache Log4j SQL Injection Vulnerability
2022-01-2000:00:00
China National Vulnerability Database
www.cnvd.org.cn
24
0.004 Low
EPSS
Percentile
74.9%
Apache Log4j, a Java-based open source logging tool from the Apache Foundation, is vulnerable to SQL injection, which stems from a JDBCAppender in Log4j 1.2.x that accepts a SQL statement as a configuration parameter, where the value to be inserted is from the PatternLayoutβs converter. The message converter \%m may always be included. An attacker could exploit this vulnerability to manipulate SQL by entering crafted strings into the input fields or headers of the logged application, allowing unexpected SQL queries to be executed.
| CPE | Name | Operator | Version |
|---|---|---|---|
| Apache Log4j >=1.2οΌ | le | 1.2.17 |
Related
ibm
ibm
nessus
nessus
Oracle Tuxedo RCE (Apr 2022 CPU)
2022-04-25 00:00:00
Oracle Identity Manager (Apr 2022 CPU)
2022-04-25 00:00:00
Oracle Application Testing Suite (Jul 2023 CPU)
2023-07-21 00:00:00
ubuntucve
ubuntucve
CVE-2022-23305
2022-01-18 00:00:00
veracode
veracode
SQL Injection
2022-01-19 12:47:45
osv
osv
SQL Injection in Log4j 1.2.x
2022-01-21 23:26:47
CVE-2022-23305
2022-01-18 16:15:08
apache-log4j1.2 - security update
2022-01-31 00:00:00
nvd
nvd
CVE-2022-23305
2022-01-18 16:15:08
cvelist
cvelist
CVE-2022-23305 SQL injection in JDBC Appender in Apache Log4j V1
2022-01-18 15:25:22
cloudlinux
cloudlinux
Fix of CVE: CVE-2022-23305
2022-02-03 20:01:40
prion
prion
Design/Logic Flaw
2022-01-18 16:15:00
githubexploit
githubexploit
Exploit for SQL Injection in Apache Log4J
2023-07-24 18:52:15
github
github
SQL Injection in Log4j 1.2.x
2022-01-21 23:26:47
cve
cve
CVE-2022-23305
2022-01-18 16:15:08
redhatcve
redhatcve
CVE-2022-23305
2022-01-18 16:16:17
debiancve
debiancve
CVE-2022-23305
2022-01-18 16:15:08
f5
f5
K97120268 : Apache Log4j SQL injection vulnerability CVE-2022-23305
2022-01-31 00:00:00
K34002344 : Overview of Log4j vulnerabilities (2021 and 2022)
2022-02-01 00:00:00
openvas
openvas
openSUSE: Security Advisory for log4j12 (openSUSE-SU-2022:0226-1)
2022-02-08 00:00:00
SUSE: Security Advisory (SUSE-SU-2022:0212-1)
2022-01-28 00:00:00
SUSE: Security Advisory (SUSE-SU-2022:0226-1)
2022-01-31 00:00:00
redhat
redhat
(RHSA-2022:0439) Important: rh-maven36-log4j12 security update
2022-02-03 18:49:50
(RHSA-2022:0442) Important: log4j security update
2022-02-07 09:41:50
oraclelinux
oraclelinux
log4j security update
2022-02-08 00:00:00
parfait:0.5 security update
2022-01-27 00:00:00
log4j security update
2022-05-23 00:00:00
suse
suse
Security update for log4j (important)
2022-01-27 00:00:00
Security update for log4j12 (important)
2022-01-28 00:00:00
Security update for kafka (important)
2022-02-16 00:00:00
centos
centos
log4j security update
2022-02-07 16:47:44
amazon
amazon
Important: log4j
2023-03-30 22:50:00
Important: log4j
2022-02-15 22:54:00
rocky
rocky
parfait:0.5 security update
2022-01-26 14:27:19
atlassian
atlassian
debian
debian
[SECURITY] [DLA 2905-1] apache-log4j1.2 security update
2022-01-31 14:24:44
ubuntu
ubuntu
Apache Log4j vulnerabilities
2023-04-05 00:00:00
almalinux
almalinux
Important: parfait:0.5 security update
2022-01-26 14:27:19
gentoo
gentoo
Apache Log4j: Multiple Vulnerabilities
2024-02-18 00:00:00
mageia
mageia
Updated davmail packages fix security vulnerability
2023-04-15 22:03:44
malwarebytes
malwarebytes
qualysblog
qualysblog
Oracle Patch Tuesday, July 2023 Security Update Review
2023-07-19 15:56:06
oracle
oracle
Oracle Critical Patch Update Advisory - January 2023
2023-01-17 00:00:00
Oracle Critical Patch Update Advisory - October 2022
2022-10-18 00:00:00
Oracle Critical Patch Update Advisory - July 2022
2022-07-19 00:00:00