Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration
Prioritize patching. It exploitation observed by VulnCheck.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apache Log4j2 can execute arbitrary code if an attacker controls the LDAP server used by the application's logging configuration. This happens through the JDBC Appender feature, which improperly validates data source names.
Log4j2 versions 2.0-beta7 through 2.17.0 are vulnerable to RCE via JNDI injection in JDBC Appender configurations. When a LDAP data source URI is specified and an attacker controls the target LDAP server, malicious code can be injected and executed. The vulnerability stems from insufficient input validation (CWE-20) and improper neutralization of special elements (CWE-74) in data source names.