Log4Shell is a zero-day vulnerability in Log4j, a popular Java logging framework, involving the execution of random code.

One of the main reasons this bug exists is that some versions of Log4j are capable of executing any text via the LDAP protocol.

The application writes data from an unverified source to the event log. An attacker can spoof log data or inject malicious content into the log. When the application processes the logs, that line could cause the vulnerable system to download and run malicious code. As a result, an attacker can potentially get full remote control over the system.

We recommend upgrading to Log4j 2.3.2 (for Java 6), 2.12.4 (for Java 7), or 2.17.1 (for Java 8 and later).

Config files : Unsafe SQL in DFM file

DerScanner Severity Score

Do you want to fix Config files : Unsafe SQL in DFM file in your application?

See also