Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM7E2A7C8E981FCA78A12F6D8992BE35354D42B960D223A90BF210EE5B300BFB9E
HistoryDec 21, 2021 - 8:44 p.m.

Security Bulletin: Log4Shell Vulnerability affects IBM SPSS Statistics Subscription (CVE-2021-44228)

2021-12-2120:44:40
www.ibm.com
20

0.976 High

EPSS

Percentile

100.0%

JSON

Summary

There is a vulnerability in the version of Log4j that is part of IBM SPSS Statistics Subscription. IBM SPSS Statistics Subscription has addressed this vulnerability.

Vulnerability Details

CVEID:CVE-2021-44228
**DESCRIPTION:**Apache Log4j could allow a remote attacker to execute arbitrary code on the system, caused by the failure to protect against attacker controlled LDAP and other JNDI related endpoints by JNDI features. By sending a specially crafted code string, an attacker could exploit this vulnerability to load arbitrary Java code on the server and take complete control of the system. Note: The vulnerability is also called Log4Shell or LogJam.
CVSS Base score: 10
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/214921 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Affected Products and Versions

Affected Product(s) Version(s)
SPSS Statistics Subscription 1.0

Remediation/Fixes

Affected Product(s) Version(s) Fixes
SPSS Statistics Subscription 1.0 Sub-Statistics28-IF002

Workarounds and Mitigations

None

CPENameOperatorVersion
ibm spss statistics subscriptioneq1.0

Related

githubexploit 42
ibm 47
kaspersky 3
threatpost 44
trellix 2
osv 4
hivepro 1
veracode 1
wallarmlab 2
nessus 10
msrc 2
impervablog 2
cisa_kev 1
rapid7blog 7
qualysblog 1
cisa 2
openvas 5
mssecure 1
redhat 3
hackerone 2
amd 1
akamaiblog 1
fedora 1
trendmicroblog 1
packetstorm 3
talosblog 1
cve 1
kitploit 1
thn 2
freebsd 1
suse 1
metasploit 1
ubuntu 1
zdt 1
githubexploit
githubexploit
Exploit for Deserialization of Untrusted Data in Apache Log4J
2022-01-09 13:38:38
Exploit for Improper Input Validation in Apache Log4J
2021-12-22 15:15:12
Exploit for Expression Language Injection in Apache Log4J
2021-12-14 14:51:26
ibm
ibm
Security Bulletin: IBM Maximo Application Suite is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-44228)
2022-02-23 18:56:25
Security Bulletin: The Apache Log4j (CVE-2021-44228) vulnerability affects z/TPF and TPF Operations Server
2021-12-20 20:53:23
Security Bulletin: IBM Security Directory Integrator NOT Affected by CVE-2021-44228 Exploit
2021-12-16 04:19:55
kaspersky
kaspersky
KLA12390 RCE vulnerability in Apache Log4j
2021-12-10 00:00:00
KLA12395 RCE vulnerability in Microsoft SQL Server
2021-12-16 00:00:00
KLA12392 RCE vulnerability in Microsoft Azure
2021-12-16 00:00:00
threatpost
threatpost
A Blockchain Primer and Bored Ape Headscratcher – Podcast
2022-03-31 13:00:09
Medusa Malware Joins Flubot's Android Distribution Network
2022-02-07 22:13:29
Samsung Confirms Lapsus$ Ransomware Hit, Source Code Leak
2022-03-07 19:28:36
trellix
trellix
Log4J and The Memory That Knew Too Much
2022-01-19 00:00:00
Log4J and The Memory That Knew Too Much
2022-01-19 00:00:00
osv
osv
Critical vulnerability in log4j may affect generated PEAR projects
2021-12-16 21:01:51
apache-log4j2 - security update
2021-12-12 00:00:00
apache-log4j2 vulnerability
2021-12-17 12:46:46
hivepro
hivepro
Iranian hackers leveraged Log4Shell to penetrate US federal agency
2022-11-17 12:28:57
veracode
veracode
Remote Code Execution (RCE)
2021-12-10 15:09:45
wallarmlab
wallarmlab
Update on Log4Shell (CVE-2021-44228)
2021-12-10 20:22:36
Log4j 0day mitigation update CVE-2021-44228
2021-12-10 20:56:40
nessus
nessus
VMware Horizon Log4Shell Direct Check (CVE-2021-44228) (VMSA-2021-0028)
2022-01-07 00:00:00
FreeBSD : graylog -- include log4j patches (3fadd7e4-f8fb-45a0-a218-8fd6423c338f)
2021-12-13 00:00:00
FreeBSD : OpenSearch -- Log4Shell (4b1ac5a3-5bd4-11ec-8602-589cfc007716)
2021-12-13 00:00:00
msrc
msrc
Microsoft’s Response to CVE-2021-44228 Apache Log4j 2
2021-12-12 05:28:18
CVE-2021-44228 Apache Log4j 2 に対するマイクロソフトの対応
2021-12-12 08:00:00
impervablog
impervablog
Continuing to Stay Ahead of CVE-2021-44228: Addressing Your Top Questions
2021-12-14 22:55:49
Analytics Are Essential for Effective Database Security
2022-01-13 15:23:02
cisa_kev
cisa_kev
Apache Log4j2 Remote Code Execution Vulnerability
2021-12-10 00:00:00
rapid7blog
rapid7blog
Metasploit Framework 6.4 Released
2024-03-25 13:33:28
3 Reasons to Join Rapid7’s Cloud Security Summit
2022-03-09 17:06:13
[Security Nation] Mike Hanley of GitHub on the Log4j Vulnerability
2022-01-19 21:47:30
qualysblog
qualysblog
Log4Shell – Follow This Multi-Layered Approach for Detection and Remediation
2021-12-28 18:00:00
cisa
cisa
Malicious Cyber Actors Continue to Exploit Log4Shell in VMware Horizon Systems
2022-06-23 00:00:00
Ivanti Updates Log4j Advisory with Security Updates for Multiple Products  
2022-01-14 00:00:00
openvas
openvas
Debian: Security Advisory (DLA-2842-1)
2021-12-13 00:00:00
openSUSE: Security Advisory for logback (openSUSE-SU-2021:1613-1)
2022-02-01 00:00:00
Fedora: Security Advisory for log4j (FEDORA-2021-66d6c484f3)
2021-12-23 00:00:00
mssecure
mssecure
MERCURY and DEV-1084: Destructive attack on hybrid environment
2023-04-07 16:00:00
redhat
redhat
(RHSA-2021:5093) Critical: Red Hat build of Eclipse Vert.x 4.1.5 SP1 security update
2021-12-14 15:57:34
(RHSA-2021:5130) Critical: Red Hat Integration Camel-K 1.6.2 release and security update
2021-12-14 17:51:25
(RHSA-2021:5126) Critical: Red Hat Integration Camel Extensions for Quarkus GA security update
2021-12-14 16:15:45
hackerone
hackerone
U.S. Dept Of Defense: ███ ████████ running a vulnerable log4j
2021-12-31 00:55:49
U.S. Dept Of Defense: ██████████ running a vulnerable log4j
2021-12-11 00:16:38
amd
amd
AMD Response to Log4j (Log4Shell) Vulnerability
2021-12-15 00:00:00
akamaiblog
akamaiblog
Threat Intelligence on Log4j CVE: Key Findings and Their Implications
2021-12-17 19:30:00
fedora
fedora
[SECURITY] Fedora 34 Update: log4j-2.16.0-1.fc34
2021-12-22 01:14:26
trendmicroblog
trendmicroblog
Patch Now: Apache Log4j Vulnerability Called Log4Shell Actively Exploited
2021-12-13 00:00:00
packetstorm
packetstorm
MobileIron Log4Shell Remote Command Execution
2022-08-03 00:00:00
Log4Shell HTTP Header Injection
2022-01-12 00:00:00
Intel Data Center Manager 5.1 Local Privilege Escalation
2022-12-09 00:00:00
talosblog
talosblog
How CVSS 4.0 changes (or doesn’t) the way we see vulnerability severity
2024-02-21 13:54:48
cve
cve
CVE-2021-44228
2021-12-10 10:15:09
kitploit
kitploit
NodeSecurityShield - A Developer And Security Engineer Friendly Package For Securing NodeJS Applications
2022-05-14 21:30:00
thn
thn
NHS Warns of Hackers Targeting Log4j Flaws in VMware Horizon
2022-01-08 07:04:00
Last Years Open Source - Tomorrow's Vulnerabilities
2022-11-01 12:04:00
freebsd
freebsd
graylog -- include log4j patches
2021-12-10 00:00:00
suse
suse
Security update for log4j (important)
2021-12-12 00:00:00
metasploit
metasploit
Log4Shell HTTP Header Injection
2021-12-29 14:10:07
ubuntu
ubuntu
Apache Log4j 2 vulnerability
2021-12-17 00:00:00
zdt
zdt
UniFi Network Application Unauthenticated Log4Shell Remote Code Execution Exploit
2022-01-24 00:00:00

0.976 High

EPSS

Percentile

100.0%

JSON
Related for 7E2A7C8E981FCA78A12F6D8992BE35354D42B960D223A90BF210EE5B300BFB9E
githubexploit42ibm47kaspersky3threatpost44trellix2osv4hivepro1veracode1wallarmlab2nessus10msrc2impervablog2cisa_kev1rapid7blog7qualysblog1cisa2openvas5mssecure1redhat3hackerone2amd1akamaiblog1fedora1trendmicroblog1packetstorm3talosblog1cve1kitploit1thn2freebsd1suse1metasploit1ubuntu1zdt1