thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Foundational

Log4Shell

A critical 2021 remote code execution vulnerability (CVE-2021-44228) in Apache Log4j 2 caused by JNDI lookups in logged strings.

Definition

Logging an attacker-controlled string containing a JNDI lookup could make the server load and execute remote code. Because Log4j was a widespread transitive dependency, organizations struggled to find affected systems, highlighting the need for SBOMs. Fixed in Log4j 2.17.x and later.

Example

Organizations with SBOMs could query which applications included vulnerable log4j-core versions within hours.

Exam tip

The poster child for SBOM value and transitive dependency risk; CVSS 10.0.

Related terms