{"uuid": "ab63f2f4-4712-40f8-a9c0-59fb28e3dbf0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-44832", "type": "seen", "source": "https://t.me/hacking_Attack/42876", "content": "Kali Linux Tutorials\nLog4J-Detector : Detects Log4J versions on your file-system within any application that are vulnerable to CVE-2021-44228 and CVE-2021-45046\n\nLog4J-Detector is a Scanner that detects vulnerable Log4J versions to help teams assess their exposure to CVE-2021-44228\u00a0(CRITICAL),\u00a0CVE-2021-45046,\u00a0CVE-2021-45105, and\u00a0CVE-2021-44832. Can search for Log4J instances by carefully examining the complete file-system, including all installed applications. It is able to find Log4J instances that are hidden several layers deep. Works on Linux, Windows, and Mac, and everywhere else Java runs, too!\n\nIntroduction\n\nCurrently reports\u00a0log4j-core\u00a0versions 2.3.2, 2.12.4, and 2.17.1 as _SAFE_, 2.3.1, 2.12.2, 2.12.3, 2.15.0, 2.16.0, and 2.17.0 as _OKAY_\u00a0and all other versions as _VULNERABLE_\u00a0(although it does report pre-2.0-beta9 as _POTENTIALLY_SAFE_). It reports older\u00a0log4j-1.x\u00a0versions as _OLD_.\n\nCan correctly detect log4j inside executable spring-boot jars/wars, dependencies blended into\u00a0uber jars, shaded jars, and even exploded jar files just sitting uncompressed on the file-system (aka *.class).\n\nWe currently maintain a collection of\u00a0log4j-samples\u00a0we use for testing.\n\nExample Usage\n\njava -jar log4j-detector-2021.12.29.jar ./samples\n\n\u2014 github.com/mergebase/log4j-detector v2021.12.29 (by mergebase.com) analyzing paths (could take a while).\n\u2014 Note: specify the \u2018\u2013verbose\u2019 flag to have every file examined printed to STDERR.\nfalse-hits/log4j-core-2.12.2.jar contains Log4J-2.x == 2.12.2 OKAY\nfalse-hits/log4j-core-2.12.3.jar contains Log4J-2.x == 2.12.3 OKAY\nfalse-hits/log4j-core-2.12.4.jar contains Log4J-2.x == 2.12.4 SAFE\nfalse-hits/log4j-core-2.15.0.jar contains Log4J-2.x == 2.15.0 OKAY\nfalse-hits/log4j-core-2.16.0.jar contains Log4J-2.x == 2.16.0 OKAY\nfalse-hits/log4j-core-2.17.0.jar contains Log4J-2.x == 2.17.0 OKAY\nfalse-hits/log4j-core-2.17.1.jar contains Log4J-2.x >= 2.17.1 SAFE\nfalse-hits/log4j-core-2.3.1.jar contains Log4J-2.x == 2.3.1 OKAY\nfalse-hits/log4j-core-2.3.2.jar contains Log4J-2.x == 2.3.2 SAFE\ntrue-hits/log4j-core-2.0-beta9.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE true-hits/log4j-core-2.10.0.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.10.0.zip contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.11.0.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.11.1.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.11.2.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.12.0.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.12.1.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.14.0.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.14.1.jar contains Log4J-2.x >= 2.10.0 VULNERABLE\ntrue-hits/log4j-core-2.2.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE true-hits/log4j-core-2.3.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE true-hits/log4j-core-2.4.1.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE true-hits/log4j-core-2.4.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE true-hits/log4j-core-2.9.1.jar contains Log4J-2.x >= 2.0-beta9 (< 2.10.0) VULNERABLE\nold-hits/log4j-1.1.3.jar contains Log4J-1.x <=OLD\nold-hits/log4j-1.2.17.jar contains Log4J-1.x <=OLD\nold-hits/log4j-core-2.0-beta2.jar contains Log4J-2.x <=POTENTIALLY_SAFE (Did you remove JndiLookup.class?)\n\nUnderstanding The Results\n\n_VULNERABLE_\u00a0-> You need to upgrade or remove this file.\n\n_OKAY_\u00a0-> We report this for Log4J versions 2.3.1, 2.12.2, 2.12.3, 2.15.0, 2.16.0, and 2.17.0. We recommend upgrading to 2.17.1.\n\n_SAFE_\u00a0-> We currently only report this for Log4J versions 2.3.2, 2.12.4, and 2.17.1 (and greater).\n\n_OLD_\u00a0-> You are safe from CVE-2021-44228, but should plan to upgrade because Log4J 1.2.x has been EOL for 7 years and has [...]", "creation_timestamp": "2026-09-02T01:02:15.520362Z"}