Log4Shell
A critical remote code execution vulnerability disclosed in 2021 within the Apache Log4j logging library, affecting millions of systems worldwide. The incident exposed structural deficiencies in the long-term maintenance and resourcing of widely adopted open-source components that underpin critical infrastructure.
Core Facts
The Log4Shell vulnerability in 2021 affected hundreds of millions of Java applications worldwide.
Log4Shell (CVE-2021-44228) received a perfect CVSS score of 10.0.
Log4j漏洞于2021年被发现，编号为CVE-2021-44228，是一个远程代码执行漏洞，影响这个被广泛使用的Java日志库
Timeline (last 90 days)
A self-updating process actively pulls new code from a remote source and executes it at runtime; if the update path is hijacked or the upstream is poisoned, the local environment will execute untrusted code without human review, making this a high-incidence point of software supply chain risk.
Software supply chain security has received widespread attention in recent years due to major incidents such as Log4Shell and SolarWinds.
The name Plugin4Shell evokes the earlier Log4Shell vulnerability, suggesting a possible connection to plugin loading mechanisms or injection chains.
The SolarWinds incident in 2021 and the Log4j vulnerability incident in 2022 made the industry aware of the severity of supply chain risks
The Log4Shell vulnerability of 2021 affected hundreds of millions of applications worldwide.
Following the SolarWinds incident and the Log4Shell vulnerability, the U.S. White House issued Executive Order EO 14028, requiring software vendors to provide an SBOM (Software Bill of Materials).
The CVE number format is CVE-YYYY-NNNNN, where CVE-2021-44228 is the well-known Log4Shell vulnerability.
The Log4Shell vulnerability originated in a logging library maintained by volunteers and affected billions of devices worldwide.
Log4Shell漏洞（CVE-2021-44228）被安全研究人员评为CVSS满分10.0，利用门槛极低，仅需在日志中注入一段JNDI查询字符串
All Facts (14)
The Log4Shell vulnerability in 2021 affected hundreds of millions of Java applications worldwide.
75%VerifiedLog4Shell (CVE-2021-44228) received a perfect CVSS score of 10.0.
75%VerifiedLog4j漏洞于2021年被发现，编号为CVE-2021-44228，是一个远程代码执行漏洞，影响这个被广泛使用的Java日志库
70%VerifiedThe Log4Shell vulnerability incident occurred in 2021.
70%UnverifiedA self-updating process actively pulls new code from a remote source and executes it at runtime; if the update path is hijacked or the upstream is poisoned, the local environment will execute untrusted code without human review, making this a high-incidence point of software supply chain risk.
50%UnverifiedSoftware supply chain security has received widespread attention in recent years due to major incidents such as Log4Shell and SolarWinds.
50%UnverifiedThe name Plugin4Shell evokes the earlier Log4Shell vulnerability, suggesting a possible connection to plugin loading mechanisms or injection chains.
50%UnverifiedFollowing the SolarWinds incident and the Log4Shell vulnerability, the U.S. White House issued Executive Order EO 14028, requiring software vendors to provide an SBOM (Software Bill of Materials).
50%UnverifiedThe CVE number format is CVE-YYYY-NNNNN, where CVE-2021-44228 is the well-known Log4Shell vulnerability.
50%UnverifiedLog4Shell漏洞（CVE-2021-44228）被安全研究人员评为CVSS满分10.0，利用门槛极低，仅需在日志中注入一段JNDI查询字符串
50%UnverifiedLog4j漏洞（CVE-2021-44228）允许攻击者通过特制字符串触发JNDI查找实现无需认证的远程代码执行
50%UnverifiedThe SolarWinds incident in 2021 and the Log4j vulnerability incident in 2022 made the industry aware of the severity of supply chain risks
50%UnverifiedThe Log4Shell vulnerability of 2021 affected hundreds of millions of applications worldwide.
50%UnverifiedThe Log4Shell vulnerability originated in a logging library maintained by volunteers and affected billions of devices worldwide.
50%