Apache Log4j - Arbitrary Code Execution in confserver/confluence (master)

XMLWordPrintable

    • Severity 2 - Major

      Issue Summary

      Arbitrary Code Execution in confserver/confluence (master)

      Steps to Reproduce

      • Vulnerability: Arbitrary Code Execution
      • Severity: High
      • Project: confserver/confluence
      • Branch: master
      • Scan Date: Unknown
        Vulnerability ID: CVE-2019-17571

      log4j-core is vulnerable to arbitrary code execution. Deserialization of untrusted data in `TcpSocketServer` and `UdpSocketServer` when listening for log data allows an attacker to execute arbitrary code via a malicious deserialization gadget.

      View more details

      Expected Results

      N/A

      Actual Results

      N/A

      Workaround

      N/A

            Assignee:
            Hasnae (Inactive)
            Reporter:
            Andrei Khudavets
            Votes:
            1 Vote for this issue
            Watchers:
            15 Start watching this issue

              Created:
              Updated:
              Resolved: