CVE-2022-23302
Deserialization of untrusted data in JMSSink in Apache Log4j 1.x
- Published
- Updated
- Reserved
- Assigned by
- apache
Description
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
Timeline
ID reserved
By apache
- 2 days later
· 2 days later
Published
- 4 years later
· 4 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| CISA-ADPADP (enrichment) | 3.1 | High8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | High8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 63.8% · top 0.8% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.
Weakness
Affected products
Apache Software Foundation · Apache Log4j 1.x
- affected 1.0.1 – < unspecified
- affected unspecified – < 2.0-alpha1
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Mavenlog4j:log4jGHSA-w9p3-5cr8-m3jj (opens in a new tab)
- Mavenorg.zenframework.z8.dependencies.commons:log4j-1.2.17GHSA-w9p3-5cr8-m3jj (opens in a new tab)
What to do
Workaround: Users should upgrade to Log4j 2 or remove usage of the JMSSink from their configurations.
References (8)
- https://lists.apache.org/thread/bsr3l5qz4g0myrjhy9h67bcxodpkwj4w (opens in a new tab)x_refsource_MISCx_transferred
- https://logging.apache.org/log4j/1.2/index.html (opens in a new tab)x_refsource_MISCx_transferred
- [oss-security] 20220118 CVE-2022-23302: Deserialization of untrusted data in JMSSink in Apache Log4j 1.x (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- https://www.oracle.com/security-alerts/cpuapr2022.html (opens in a new tab)x_refsource_MISCx_transferred
- https://security.netapp.com/advisory/ntap-20220217-0006/ (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://www.oracle.com/security-alerts/cpujul2022.html (opens in a new tab)x_refsource_MISCx_transferred
- https://www.vicarius.io/vsociety/posts/cve-2022-23302-detect-log4j-1217-vulnerability (opens in a new tab)
- https://www.vicarius.io/vsociety/posts/cve-2022-23302-mitigate-log4j-1217-vulnerability (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-w9p3-5cr8-m3jj (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-23302)Record last updated .