UpHeron
All vulnerabilities

Servers and applications

CVE-2021-4104

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2…

Severity
High 7.5
Published
14 Dec 2021
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
Apache Log4jServers and applications · cpe:a:apache:log4j
  • Version 1.2
Oracle WebLogic ServerServers and applications · cpe:a:oracle:weblogic_server
  • Version 12.2.1.3.0
  • Version 12.2.1.4.0
  • Version 14.1.1.0.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-4104
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-4104