CVE-2017-5645

EPSS 89.0%

Vexday Risk Score

40Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS —EPSS 89.0%KEV nãoPoC —Nuclei simMetasploit —Patch referenciado

Lifecycle

17 Apr 2017Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

Affected products

Apache Software Foundation · Apache Log4j

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References