CVE-2022-23305 vulnerability in Apache and Other Products
Published on January 18, 2022

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

NVD

Weakness Type

What is a SQL Injection Vulnerability?

The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.

CVE-2022-23305 has been classified to as a SQL Injection vulnerability or weakness.

Products Associated with CVE-2022-23305

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2022-23305 are published in these products:

Apache Log4j

NetApp Snapmanager

Broadcom Brocade Sannav

Qos Reload4j

Oracle Weblogic Server

Oracle Business Intelligence

Oracle Business Process Management Suite

Oracle Jdeveloper

Oracle Identity Management Suite

Oracle Enterprise Manager Base Platform

Oracle Communications Network Integrity

Oracle Advanced Supply Chain Planning

Oracle Communications Eagle Ftp Table Base Retrieval

Oracle Communications Messaging Server

Oracle Communications Unified Inventory Management

Oracle E Business Suite Cloud Manager Cloud Backup Module

Oracle Financial Services Revenue Management Billing Analytics

Oracle Healthcare Foundation

Oracle Hyperion Data Relationship Management

Oracle Hyperion Infrastructure Technology

Oracle Identity Manager Connector

Oracle Middleware Common Libraries Tools

Oracle Mysql Enterprise Monitor

Oracle Tuxedo

Oracle Retail Extract Transform Load

Oracle Communications Instant Messaging Server

Oracle Communications Offline Mediation Controller

Oracle E Business Suite Information Discovery

Canonical Ubuntu Linux

Oracle

Affected Versions

Apache Software Foundation Apache Log4j 1.x :

Version 1.2.1 and below unspecified is affected.
Version unspecified and below 2.0-alpha1 is affected.

Exploit Probability

EPSS

7.95%

Percentile

91.78%