GHSA-65fg-84f6-3jq3 · Severity: critical · Ecosystem: maven — SQL Injection in Log4j 1.2.x
By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
Conclusion & alert: CVE-2022-23305 is rated High Risk (78.9/100): CVSS Critical severity, with high exploitation likelihood (EPSS 67.47%, 99th percentile). Core evidence: EPSS ranks this CVE among the most likely to be exploited in the near term. EPSS rose +58.01% over the last day, indicating growing attacker interest. Mandatory action: High exploitation likelihood—assess exposure and prioritize remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 9.45% | 67.47% | +58.01% |
| 2 | 2026-04-26 | 11.56% | 9.45% | -2.11% |
| 3 | 2026-04-24 | — | 11.56% | — |
Full EPSS history (33 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 9.8 | 3.1 | CRITICAL |
|
3.9 | 5.9 | [email protected] |
| 9.8 | 3.1 | CRITICAL |
|
3.9 | 5.9 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
| 6.8 | 2.0 | MEDIUM |
|
8.6 | 6.4 | [email protected] |
GHSA-65fg-84f6-3jq3 · Severity: critical · Ecosystem: maven — SQL Injection in Log4j 1.2.x
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2022-23305 not yet assigned priority: Debian including 1 source packages (apache-log4j1.2), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2022-23305 |
gentoo
|
normal | CVE-2022-23305: 1 GLSA(s) (202402-16), 1 atom(s) (dev-java/log4j); latest impact normal. | https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2022-23305 |
redhat
|
high | — | https://access.redhat.com/security/cve/CVE-2022-23305 |
suse
|
high | CVE-2022-23305 severity important: SUSE including 336 source package names (amazon/suse-sles-15-sp1-chost-byos-v20210304-hvm-ssd-x86_64, amazon/suse-sles-15-sp1-chost-byos-v20220127-hvm-ssd-x86_64, …), 499 product×package rows across 62 product lines (HPE Helion OpenStack 8, SUSE CaaS Platform 4.0, … (62 product lines)): Fixed 264, Known Affected 231, Known Not Affected 4. | https://www.suse.com/security/cve/CVE-2022-23305/ |
ubuntu
|
medium | CVE-2022-23305 medium priority: Ubuntu including 1 source packages (apache-log4j1.2), 13 status rows across 13 suites (bionic, focal, impish, jammy, kinetic, lunar, mantic, noble, oracular, plucky, trusty, upstream, xenial): not-affected 5, released 5, ignored 3. | https://ubuntu.com/security/CVE-2022-23305 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| apache | log4j | >= 1.2, <= 1.2.17 | cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:* |
| netapp | snapmanager | — | cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:* |
| netapp | snapmanager | — | cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:* |
| broadcom | brocade_sannav | — | cpe:2.3:a:broadcom:brocade_sannav:-:*:*:*:*:*:*:* |
| qos | reload4j | < 1.2.18.2 | cpe:2.3:a:qos:reload4j:*:*:*:*:*:*:*:* |
| oracle | advanced_supply_chain_planning | 12.1 | cpe:2.3:a:oracle:advanced_supply_chain_planning:12.1:*:*:*:*:*:*:* |
| oracle | advanced_supply_chain_planning | 12.2 | cpe:2.3:a:oracle:advanced_supply_chain_planning:12.2:*:*:*:*:*:*:* |
| oracle | business_intelligence | 5.9.0.0.0 | cpe:2.3:a:oracle:business_intelligence:5.9.0.0.0:*:*:*:enterprise:*:*:* |
| oracle | business_intelligence | 12.2.1.3.0 | cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:* |
| oracle | business_intelligence | 12.2.1.4.0 | cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:* |
| oracle | business_process_management_suite | 12.2.1.3.0 | cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:* |
| oracle | business_process_management_suite | 12.2.1.4.0 | cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:* |
| oracle | communications_eagle_ftp_table_base_retrieval | 4.5 | cpe:2.3:a:oracle:communications_eagle_ftp_table_base_retrieval:4.5:*:*:*:*:*:*:* |
| oracle | communications_instant_messaging_server | 10.0.1.5.0 | cpe:2.3:a:oracle:communications_instant_messaging_server:10.0.1.5.0:*:*:*:*:*:*:* |
| oracle | communications_messaging_server | 8.1 | cpe:2.3:a:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:* |
| oracle | communications_network_integrity | 7.3.6 | cpe:2.3:a:oracle:communications_network_integrity:7.3.6:*:*:*:*:*:*:* |
| oracle | communications_offline_mediation_controller | < 12.0.0.4.4 | cpe:2.3:a:oracle:communications_offline_mediation_controller:*:*:*:*:*:*:*:* |
| oracle | communications_offline_mediation_controller | 12.0.0.5.0 | cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.5.0:*:*:*:*:*:*:* |
| oracle | communications_unified_inventory_management | 7.4.1 | cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.1:*:*:*:*:*:*:* |
| oracle | communications_unified_inventory_management | 7.4.2 | cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.2:*:*:*:*:*:*:* |
| oracle | e-business_suite_cloud_manager_and_cloud_backup_module | < 2.2.1.1.1 | cpe:2.3:a:oracle:e-business_suite_cloud_manager_and_cloud_backup_module:*:*:*:*:*:*:*:* |
| oracle | e-business_suite_cloud_manager_and_cloud_backup_module | 2.2.1.1.1 | cpe:2.3:a:oracle:e-business_suite_cloud_manager_and_cloud_backup_module:2.2.1.1.1:*:*:*:*:*:*:* |
| oracle | e-business_suite_information_discovery | >= 12.2.3, <= 12.2.11 | cpe:2.3:a:oracle:e-business_suite_information_discovery:*:*:*:*:*:*:*:* |
| oracle | enterprise_manager_base_platform | 13.4.0.0 | cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:* |
| oracle | enterprise_manager_base_platform | 13.5.0.0 | cpe:2.3:a:oracle:enterprise_manager_base_platform:13.5.0.0:*:*:*:*:*:*:* |
| oracle | financial_services_revenue_management_and_billing_analytics | 2.7.0.0 | cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.7.0.0:*:*:*:*:*:*:* |
| oracle | financial_services_revenue_management_and_billing_analytics | 2.7.0.1 | cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.7.0.1:*:*:*:*:*:*:* |
| oracle | financial_services_revenue_management_and_billing_analytics | 2.8.0.0 | cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.8.0.0:*:*:*:*:*:*:* |
| oracle | healthcare_foundation | 8.1.0 | cpe:2.3:a:oracle:healthcare_foundation:8.1.0:*:*:*:*:*:*:* |
| oracle | hyperion_data_relationship_management | < 11.2.8.0 | cpe:2.3:a:oracle:hyperion_data_relationship_management:*:*:*:*:*:*:*:* |
| oracle | hyperion_infrastructure_technology | < 11.2.8.0 | cpe:2.3:a:oracle:hyperion_infrastructure_technology:*:*:*:*:*:*:*:* |
| oracle | identity_management_suite | 12.2.1.3.0 | cpe:2.3:a:oracle:identity_management_suite:12.2.1.3.0:*:*:*:*:*:*:* |
| oracle | identity_management_suite | 12.2.1.4.0 | cpe:2.3:a:oracle:identity_management_suite:12.2.1.4.0:*:*:*:*:*:*:* |
| oracle | identity_manager_connector | 11.1.1.5.0 | cpe:2.3:a:oracle:identity_manager_connector:11.1.1.5.0:*:*:*:*:*:*:* |
| oracle | jdeveloper | 12.2.1.3.0 | cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:* |
| oracle | middleware_common_libraries_and_tools | 12.2.1.4.0 | cpe:2.3:a:oracle:middleware_common_libraries_and_tools:12.2.1.4.0:*:*:*:*:*:*:* |
| oracle | mysql_enterprise_monitor | <= 8.0.29 | cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* |
| oracle | retail_extract_transform_and_load | 13.2.5 | cpe:2.3:a:oracle:retail_extract_transform_and_load:13.2.5:*:*:*:*:*:*:* |
| oracle | tuxedo | 12.2.2.0.0 | cpe:2.3:a:oracle:tuxedo:12.2.2.0.0:*:*:*:*:*:*:* |
| oracle | weblogic_server | 12.2.1.3.0 | cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* |
| oracle | weblogic_server | 12.2.1.4.0 | cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* |
| oracle | weblogic_server | 14.1.1.0.0 | cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* |
| URL | Tags |
|---|---|
| http://www.openwall.com/lists/oss-security/2022/01/18/4 | Mailing List Third Party Advisory |
| https://lists.apache.org/thread/pt6lh3pbsvxqlwlp4c5l798dv2hkc85y | Issue Tracking Mailing List Vendor Advisory |
| https://logging.apache.org/log4j/1.2/index.html | Vendor Advisory |
| https://security.netapp.com/advisory/ntap-20220217-0007/ | Third Party Advisory |
| https://www.oracle.com/security-alerts/cpuapr2022.html | Patch Third Party Advisory |
| https://www.oracle.com/security-alerts/cpujul2022.html | Patch Third Party Advisory |