CVE-2022-23302: Deserialization of untrusted data in JMSSink in Apache Log4j 1.x
Vulnerability summary
CVE-2022-23302 is a high (CVSS 8.8) Deserialization of Untrusted Data vulnerability in apache software foundation apache log4j 1.x. EPSS estimates a 63.84% chance of exploitation in the next 30 days, higher than 99.2% of scored vulnerabilities.
Not severe (CVSS 8.8, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 31 · Related 13Timeline
- 18-01-2022PublishedVulnerability first disclosed.
- 27-05-2026Last modifiedVulnerability information updated.
Description
JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
CVSS metrics
8 scores · 7 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · MavenEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
63.84%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
Increase +0.29 pp
From 63.56% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Oracle22 products
- advanced_supply_chain_planning12.1 | 12.2
- business_intelligence5.9.0.0.0 | 12.2.1.3.0 | 12.2.1.4.0
- business_process_management_suite12.2.1.3.0 | 12.2.1.4.0
- communications_eagle_ftp_table_base_retrieval4.5
- communications_instant_messaging_server10.0.1.5.0
Chainguard4 products
- druidAll versions (No fix recorded) | < 35.0.1-r1
- hadoop-fips-3.3.6All versions (No fix recorded)
- hadoop-fips-3.4.2All versions (No fix recorded)
- hadoop-fips-3.5All versions (No fix recorded)
Apache1 product
- log4j≥ 1.0.1, ≤ 1.2.17
Apache software foundation1 product
- apache log4j 1.x≥ 1.0.1, < unspecified | ≥ unspecified, < 2.0-alpha1
Broadcom1 product
Debian1 product
- apache-log4j1.2< 1.2.17-11
Log4j1 product
- log4j≤ 1.2.17
Netapp1 product
Org.zenframework.z8.dependencies.commons1 product
- log4j-1.2.17≤ 2.0
Qos1 product
- reload4j< 1.2.18.1
Ubuntu1 product
- apache-log4j1.2< 1.2.17-4ubuntu3+esm2 | < 1.2.17-7ubuntu1+esm1 | < 1.2.17-8+deb10u1ubuntu0.2 | < 1.2.17-9ubuntu0.2
Wolfi1 product
- druidAll versions (No fix recorded) | < 35.0.1-r1
12 vendors · 36 products
References
18 links- lists.apache.org/thread/bsr3l5qz4g0myrjhy9h67bcxodpkwj4wX Refsource MISCREPORTWEBMailing ListMitigationVendor Advisory
- www.openwall.com/lists/oss-security/2022/01/18/3Mailing ListX Refsource MLISTARTICLEWEBThird Party Advisory
