UpHeron
All vulnerabilities

Servers and applications

CVE-2022-23305

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be…

Severity
Critical 9.8
Published
18 Jan 2022
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
Apache Log4jServers and applications · cpe:a:apache:log4j
  • From 1.2 up to 1.2.17
Oracle WebLogic ServerServers and applications · cpe:a:oracle:weblogic_server
  • Version 12.2.1.3.0
  • Version 12.2.1.4.0
  • Version 14.1.1.0.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-23305
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-23305