Log4Shell
Sign in to saveAlso known as CVE-2021-44228
Log4Shell (CVE-2021-44228) is a vulnerability reported in November 2021 in Log4j, a popular Java logging framework, involving arbitrary code execution and exploited as a zero-day vulnerability. The vulnerability had existed unnoticed since 2013 and was privately disclosed to the Apache Software Foundation, of which Log4j is a project, by Chen Zhaojun of Alibaba Cloud's security team on 24 November 2021.
Key facts
- Bug.name
- Log4Shell
- Bug.discoverer
- Chen Zhaojun of the Alibaba Cloud Security Team
- Bug.affected software
- Applications logging user input using Log4j 2
via Wikipedia infobox
Wikidata facts
- Official website
- log4.sh
Show 4 more facts
- hashtag
- log4shell
- Stack Exchange tag
- stackoverflow.com/tags/log4shell
- announcement date
- 2021-12-09
- time of discovery or invention
- 2021-11-24
via Wikidata · CC0
~14 min read
Article
11 sectionsContents
- Background
- Behavior
- Mitigation
- Usage
- Response and impact
- Governmental
- Businesses
- Privacy
- Analysis
- References
- External links
Log4Shell (CVE-2021-44228) is a vulnerability reported in November 2021 in Log4j, a popular Java logging framework, involving arbitrary code execution and exploited as a zero-day vulnerability. The vulnerability had existed unnoticed since 2013 and was privately disclosed to the Apache Software Foundation, of which Log4j is a project, by Chen Zhaojun of Alibaba Cloud's security team on 24 November 2021.
Before an official CVE identifier was made available on 10 December 2021, the vulnerability circulated with the name "Log4Shell", given by Free Wortley of the LunaSec team, which was initially used to track the issue online. Apache gave Log4Shell a CVSS severity rating of 10, the highest available score. The exploit was simple to execute and is estimated to have had the potential to affect hundreds of millions of devices.