CVE-2022-23307
Assigner: apache
Published: 2022-01-18T15:25:23
State: PUBLISHED
affected: product: Apache Log4j 1.x
vendor: Apache Software Foundation
versions: lessThan: unspecified
status: affected
version: 1.2.1
versionType: custom
lessThanOrEqual: 2.0-alpha1
status: affected
version: unspecified
versionType: custom
credits: value: @kingkk
descriptions: value: CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.
metrics: other: content: other: Critical
type: unknown
problemTypes: descriptions: cweId: CWE-502
description: CWE-502 Deserialization of Untrusted Data
type: CWE
source: discovery: UNKNOWN
title:  A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.
workarounds: value: Upgrade to Apache Log4j 2 and Apache Chainsaw 2.1.0.
x_generator: engine: Vulnogram 0.0.9