CVE-2022-23302

8.8 HIGH

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j c...

Published: 2022-01-18 · Last updated: 2025-07-07

Severity and scoring

CVSS: 8.8 HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-502

Affected products

Vendor	Product
apache	advanced_supply_chain_planning, brocade_sannav, business_intelligence
broadcom	advanced_supply_chain_planning, brocade_sannav, business_intelligence
netapp	advanced_supply_chain_planning, brocade_sannav, business_intelligence
oracle	advanced_supply_chain_planning, brocade_sannav, business_intelligence
qos	advanced_supply_chain_planning, brocade_sannav, business_intelligence

Description

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2022-23302
[Other]http://www.openwall.com/lists/oss-security/2022/01/18/3
[Vendor advisory]https://lists.apache.org/thread/bsr3l5qz4g0myrjhy9h67bcxodpkwj4w
[Vendor advisory]https://logging.apache.org/log4j/1.2/index.html
[Other]https://security.netapp.com/advisory/ntap-20220217-0006/
[Patch]https://www.oracle.com/security-alerts/cpuapr2022.html
[Patch]https://www.oracle.com/security-alerts/cpujul2022.html
[Other]http://www.openwall.com/lists/oss-security/2022/01/18/3
[Vendor advisory]https://lists.apache.org/thread/bsr3l5qz4g0myrjhy9h67bcxodpkwj4w
[Vendor advisory]https://logging.apache.org/log4j/1.2/index.html
[Other]https://security.netapp.com/advisory/ntap-20220217-0006/
[Patch]https://www.oracle.com/security-alerts/cpuapr2022.html
[Patch]https://www.oracle.com/security-alerts/cpujul2022.html
[Other]https://www.vicarius.io/vsociety/posts/cve-2022-23302-detect-log4j-1217-vulnerability
[Other]https://www.vicarius.io/vsociety/posts/cve-2022-23302-mitigate-log4j-1217-vulnerability

Related CVEs

Same vendor

CVE-2026-34905 — Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer (6.5 MEDIUM)
CVE-2026-34031 — Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer (6.5 MEDIUM)
CVE-2026-33582 — Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer (6.5 MEDIUM)
CVE-2026-25699 — Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer (6.1 MEDIUM)
CVE-2026-25688 — Improper Neutralization of Alternate XSS Syntax vulnerability in Apache Answer (6.1 MEDIUM)

Same CWE

CVE-2026-20251 — In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, ... (8.8 HIGH)
CVE-2026-53435 — In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, it is possible for attackers to have Jenkins deserialize arbitrary types defined i... (8.8 HIGH)
CVE-2026-52751 — Ghidra before 12.1 contains an unsafe deserialization vulnerability in client-side Shared-Project RMI connection code that allows unauthe... (8.8 HIGH)
CVE-2026-10721 — Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the in Permission, Cache, and Search components
CVE-2026-11815 — An attacker who intercepts and tampers with traffic between the client application and the API Gateway server could potentially deseriali...