Vulnerability Name: CVE-2022-23305 (CCN-217461) Assigned: 2022-01-18 Published: 2022-01-18 Updated: 2023-02-24 Summary: By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions. CVSS v3 Severity: 9.8 Critical (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9.4 Critical (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C Exploitability Metrics: Attack Vector (AV): NetworkAttack Complexity (AC): LowPrivileges Required (PR): NoneUser Interaction (UI): NoneScope: Scope (S): UnchangedImpact Metrics: Confidentiality (C): HighIntegrity (I): HighAvailibility (A): High
6.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N 6.2 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:H/RL:O/RC:C Exploitability Metrics: Attack Vector (AV): NetworkAttack Complexity (AC): LowPrivileges Required (PR): NoneUser Interaction (UI): NoneScope: Scope (S): UnchangedImpact Metrics: Confidentiality (C): LowIntegrity (I): LowAvailibility (A): None
8.8 High (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 8.4 High (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C Exploitability Metrics: Attack Vector (AV): NetworkAttack Complexity (AC): LowPrivileges Required (PR): LowUser Interaction (UI): NoneScope: Scope (S): UnchangedImpact Metrics: Confidentiality (C): HighIntegrity (I): HighAvailibility (A): High
CVSS v2 Severity: 6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P Exploitability Metrics: Access Vector (AV): NetworkAccess Complexity (AC): MediumAuthentication (Au): NoneImpact Metrics: Confidentiality (C): PartialIntegrity (I): PartialAvailibility (A): Partial
6.4 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N Exploitability Metrics: Access Vector (AV): NetworkAccess Complexity (AC): LowAthentication (Au): NoneImpact Metrics: Confidentiality (C): PartialIntegrity (I): PartialAvailibility (A): None
Vulnerability Type: CWE-89 Vulnerability Consequences: Data Manipulation References: Source: MITRECVE-2022-23305 security@apache.org apache-cve202223305-sql-injection(217461) security@apache.org Apache log4j 1.2 security@apache.org CVE-2022-23305: SQL injection in JDBC Appender in Apache Log4j V1 security@apache.org Due to use of Apache Log4j, IBM Db2 Web Query for i is vulnerable to arbitrary code execution (CVE-2021-4104, CVE-2022-23302, and CVE-2022-23307) and SQL injection (CVE-2022-23305) Log4j vulnerabilities affect IBM Netezza Analytics for NPS IBM App Connect for Healthcare is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2022-23305) Log4j vulnerabilities affect IBM Netezza Analytics IBM Sterling Connect:Direct Web Services is vulnerable to SQL injection due to Apache Log4j (CVE-2022-23305) IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to arbitrary code execution and SQL injection due to Apache Log4j. (CVE-2022-23302, CVE-2022-23307, CVE-2022-23305) Due to use of Apache Log4j, IBM Netcool/OMNIbus Probe DSL Factory Framework is vulnerable to arbitrary code execution (CVE-2022-23302, CVE-2022-23307) and SQL injection (CVE-2022-23305) Vulnerability in Apache Log4j affects IBM Cloud Pak for Data System 1.0 Cloudera Data Platform Private Cloud Base with IBM products have log messages vulnerable to arbitrary code execution, denial of service, remote code execution, and SQL injection due to Apache Log4j vulnerabilities IBM Urbancode Deploy impacted by Apache Log4j SQL Injection vulnerability. (CVE-2022-23305) IBM Spectrum Discover is vulnerable to Docker CLI (CVE-2021-41092) and Apache Log4j (CVE-2021-4104, CVE-2022-23302, CVE-2022-23305, CVE-2022-23307) weaknesses IBM App Connect Enterprise & IBM Integration Bus are vulnerable to arbitrary code execution due to Apache Log4j (CVE-2022-23307, CVE-2022-23302) and SQL injection due to Apache Log4j (CVE-2022-23305) IBM Tivoli Netcool Impact is affected by an Apache Log4j vulnerability (CVE-2022-23305) Apache Log4j vulnerability Curam Social Program Management is vulnerable to arbitrary code execution and SQL injection issues due to Apache Log4j (CVE-2022-23302, CVE-2022-23305, CVE-2022-23307) Crypto Hardware Initialization and Maintenance is vulnerable to arbitrary code execution due to Apache Log4j (CVE 2021-4104, CVE 2022-23302, CVE 2022-23305, CVE 2022-23307) Multiple vulnerabilities in Apache Log4j affect IBM Cloud Pak System IBM Cognos Controller is affected but not vulnerable to arbitrary code execution and SQL injection due to Apache Log4j v1 vulnerabilities (CVE-2022-23305, CVE-2022-23302, CVE-2021-4104) IBM Telco Network Cloud Manager - Performance is vulnerable to arbitrary code execution due to Apache Log4j (CVE-2021-44832,CVE-2022-23302 and CVE-2022-23305) IBM OpenPages with Watson has addressed Apache Log4j vulnerability (CVE-2022-23305) IBM Cloud Pak for Multicloud Management Monitoring is potentially vulnerable to execution of arbitrary code due to its use of Apache Log4j (CVE-2022-23305) Multiple vulnerabilities in log4j-1.2.16.jar used by IBM Operations Analytics - Log Analysis IBM Data Risk Manager is affected by multiple vulnerabilities including remote code execution in Apache Log4j 1.x IBM InfoSphere Information Server may be affected by vulnerabilities in Apache log4j 1.x version IBM Sterling Order Management migration strategy to Apache Log4j vulnerability (see CVEs below) IBM Operations Analytics Predictive Insights impacted by Apache Log4j vulnerabilities (CVE-2022-23305) Netcool Operations Insight v1.6.7 contains fixes for multiple security vulnerabilities. Vulnerability in Log4j affects IBM Integrated Analytics System [CVE-2022-23305] Oracle Critical Patch Update Advisory - April 2022 security@apache.org Oracle Critical Patch Update Advisory - July 2022 security@apache.org Vulnerable Configuration: Configuration RedHat 1 :cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:* Configuration RedHat 2 :cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:* Configuration RedHat 3 :cpe:/o:redhat:enterprise_linux:7:*:*:*:*:*:*:* Configuration RedHat 4 :cpe:/o:redhat:enterprise_linux:7::client:*:*:*:*:* Configuration RedHat 5 :cpe:/o:redhat:enterprise_linux:7::computenode:*:*:*:*:* Configuration RedHat 6 :cpe:/o:redhat:enterprise_linux:7::server:*:*:*:*:* Configuration RedHat 7 :cpe:/o:redhat:enterprise_linux:7::workstation:*:*:*:*:* Configuration RedHat 8 :cpe:/o:redhat:rhel_els:6:*:*:*:*:*:*:* Configuration CCN 1 :cpe:/a:apache:log4j:1.2:-:*:*:*:*:*:* AND cpe:/a:ibm:websphere_application_server:7.0:*:*:*:*:*:*:* OR cpe:/a:ibm:websphere_application_server:8.0:*:*:*:*:*:*:* OR cpe:/a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:* OR cpe:/a:ibm:tivoli_netcool/impact:7.1.0:*:*:*:*:*:*:* OR cpe:/a:ibm:tivoli_netcool/omnibus:8.1.0:*:*:*:*:*:*:* OR cpe:/a:ibm:websphere_application_server:9.0:*:*:*:*:*:*:* OR cpe:/a:ibm:operations_analytics_predictive_insights:1.3.3:*:*:*:*:*:*:* OR cpe:/a:ibm:operations_analytics_predictive_insights:1.3.5:*:*:*:*:*:*:* OR cpe:/a:ibm:operations_analytics_predictive_insights:1.3.6:*:*:*:*:*:*:* OR cpe:/a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* OR cpe:/a:oracle:identity_manager:12.2.1.3.0:*:*:*:*:*:*:* OR cpe:/a:oracle:business_intelligence:12.2.1.3.0::~~enterprise~~~:*:*:*:*:* OR cpe:/a:ibm:infosphere_information_server:11.7:*:*:*:*:*:*:* OR cpe:/a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:* OR cpe:/a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:* OR cpe:/a:oracle:business_intelligence:12.2.1.4.0::~~enterprise~~~:*:*:*:*:* OR cpe:/a:ibm:app_connect:11.0.0.0:*:*:*:enterprise:*:*:* OR cpe:/a:ibm:cognos_controller:10.4.0:*:*:*:*:*:*:* OR cpe:/a:ibm:cognos_controller:10.4.1:*:*:*:*:*:*:* OR cpe:/a:ibm:urbancode_deploy:6.2.7:*:*:*:*:*:*:* OR cpe:/a:ibm:urbancode_deploy:7.0.3:*:*:*:*:*:*:* OR cpe:/a:ibm:cloud_pak_system:2.3:*:*:*:*:*:*:* OR cpe:/a:ibm:cloud_pak_system:2.3.0.1:*:*:*:*:*:*:* OR cpe:/a:ibm:websphere_application_server:17.0.0.3:*:*:*:liberty:*:*:* OR cpe:/a:ibm:cloud_pak_system:2.3.1.1:*:*:*:*:*:*:* OR cpe:/a:ibm:urbancode_deploy:7.0.5:*:*:*:*:*:*:* OR cpe:/a:ibm:cloud_pak_system:2.3.2.0:*:*:*:*:*:*:* OR cpe:/a:ibm:cognos_controller:10.4.2:*:*:*:*:*:*:* OR cpe:/a:ibm:cloud_pak_system:2.3.3.1:*:*:*:*:*:*:* OR cpe:/a:ibm:cloud_pak_system:2.3.3.2:*:*:*:*:*:*:* OR cpe:/a:ibm:cloud_pak_system:2.3.3.3:*:*:*:*:*:*:* OR cpe:/a:ibm:integration_bus:10.0.0.6:*:*:*:*:*:*:* OR cpe:/a:ibm:websphere_application_server:21.0.0.12:*:*:*:liberty:*:*:* OR cpe:/a:ibm:sterling_order_management:10:*:*:*:*:*:*:* Oval Definitions BACK
apache log4j 1.2 -
ibm websphere application server 7.0
ibm websphere application server 8.0
ibm websphere application server 8.5
ibm tivoli netcool/impact 7.1.0
ibm tivoli netcool/omnibus 8.1.0
ibm websphere application server 9.0
ibm operations analytics predictive insights 1.3.3
ibm operations analytics predictive insights 1.3.5
ibm operations analytics predictive insights 1.3.6
oracle weblogic server 12.2.1.3.0
oracle identity manager 12.2.1.3.0
oracle business intelligence 12.2.1.3.0
ibm infosphere information server 11.7
oracle business process management suite 12.2.1.3.0
oracle jdeveloper 12.2.1.3.0
oracle business intelligence 12.2.1.4.0
ibm app connect 11.0.0.0
ibm cognos controller 10.4.0
ibm cognos controller 10.4.1
ibm urbancode deploy 6.2.7
ibm urbancode deploy 7.0.3
ibm cloud pak system 2.3
ibm cloud pak system 2.3.0.1
ibm websphere application server 17.0.0.3
ibm cloud pak system 2.3.1.1
ibm urbancode deploy 7.0.5
ibm cloud pak system 2.3.2.0
ibm cognos controller 10.4.2
ibm cloud pak system 2.3.3.1
ibm cloud pak system 2.3.3.2
ibm cloud pak system 2.3.3.3
ibm integration bus 10.0.0.6
ibm websphere application server 21.0.0.12
ibm sterling order management 10
Denotes that component is vulnerable