CVE-2021-3100
19.04.2022, 23:15
The Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.1-13 didnt mimic the permissions of the JVM being patched, allowing it to escalate privileges.Enginsight
| Vendor | Product | Version |
|---|---|---|
| amazon | log4jhotpatch | 𝑥 < 1.1-13 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-250 - Execution with Unnecessary PrivilegesThe software performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.
- CWE-269 - Improper Privilege ManagementThe software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
References