CVE-2022-23305

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

• Apache Log4j

  APP
  Apache
  1.2 – 1.2.17

• Broadcom Brocade Sannav

  APP
  Broadcom
  wszystkie wersje

• Netapp Snapmanager

  APP
  Netapp
  wszystkie wersje

• Oracle Advanced Supply Chain Planning

  APP
  Oracle
  12.112.2

• Oracle Business Intelligence

  APP
  Oracle
  12.2.1.3.012.2.1.4.05.9.0.0.0

• Oracle Business Process Management Suite

  APP
  Oracle
  12.2.1.3.012.2.1.4.0

• Oracle Communications Eagle Ftp Table Base Retrieval

  APP
  Oracle
  4.5

• Oracle Communications Instant Messaging Server

  APP
  Oracle
  10.0.1.5.0

• Oracle Communications Messaging Server

  APP
  Oracle
  8.1

• Oracle Communications Network Integrity

  APP
  Oracle
  7.3.6

• Oracle Communications Offline Mediation Controller

  APP
  Oracle
  12.0.0.5.0< 12.0.0.4.4

• Oracle Communications Unified Inventory Management

  APP
  Oracle
  7.4.17.4.2

• Oracle E Business Suite Cloud Manager And Cloud Backup Module

  APP
  Oracle
  2.2.1.1.1< 2.2.1.1.1

• Oracle E Business Suite Information Discovery

  APP
  Oracle
  12.2.3 – 12.2.11

• Oracle Enterprise Manager Base Platform

  APP
  Oracle
  13.4.0.013.5.0.0

• Oracle Financial Services Revenue Management And Billing Analytics

  APP
  Oracle
  2.7.0.02.7.0.12.8.0.0

• Oracle Healthcare Foundation

  APP
  Oracle
  8.1.0

• Oracle Hyperion Data Relationship Management

  APP
  Oracle
  < 11.2.8.0

• Oracle Hyperion Infrastructure Technology

  APP
  Oracle
  < 11.2.8.0

• Oracle Identity Management Suite

  APP
  Oracle
  12.2.1.3.012.2.1.4.0

• Oracle Identity Manager Connector

  APP
  Oracle
  11.1.1.5.0

• Oracle Jdeveloper

  APP
  Oracle
  12.2.1.3.0

• Oracle Middleware Common Libraries And Tools

  APP
  Oracle
  12.2.1.4.0

• Oracle MySQL Enterprise Monitor

  APP
  Oracle
  ≤ 8.0.29

• Oracle Retail Extract Transform And Load

  APP
  Oracle
  13.2.5

• Oracle Tuxedo

  APP
  Oracle
  12.2.2.0.0

• Oracle Weblogic Server

  APP
  Oracle
  12.2.1.3.012.2.1.4.014.1.1.0.0

• Qos Reload4j

  APP
  Qos
  < 1.2.18.2