CVE-2022-23305: SQL injection in JDBC Appender in Apache Log4j V1

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 66.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-01-18 · updated 2026-06-17
Weakness: CWE-89

Description

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

Affected products

Apache Log4j: from 1.2 through 1.2.17
Brocade SANnav: all versions
SnapManager for Oracle: all versions
Oracle Corporation Oracle Advanced Supply Chain Planning: 12.1, 12.2
Oracle Corporation Oracle Business Intelligence Enterprise Edition: 5.9.0.0.0, 12.2.1.3.0, 12.2.1.4.0
Oracle Corporation Oracle Business Process Management Suite: 12.2.1.3.0, 12.2.1.4.0
Oracle Communications Eagle Ftp Table Base Retrieval: 4.5
Oracle Communications Instant Messaging Server: 10.0.1.5.0
Oracle Communications Messaging Server: 8.1
Oracle Communications Network Integrity: 7.3.6
Oracle Communications Offline Mediation Controller: before 12.0.0.4.4; 12.0.0.5.0 — fixed in 12.0.0.4.4
Oracle Corporation Oracle Communications Unified Inventory Management: 7.4.1, 7.4.2
Oracle E-Business Suite Cloud Manager And Cloud Backup Module: before 2.2.1.1.1; 2.2.1.1.1 — fixed in 2.2.1.1.1
Oracle E-Business Suite Information Discovery: from 12.2.3 through 12.2.11
Oracle Corporation Enterprise Manager Base Platform: 13.4.0.0, 13.5.0.0
Oracle Financial Services Revenue Management And Billing Analytics: 2.7.0.0, 2.7.0.1, 2.8.0.0
Oracle Healthcare Foundation: 8.1.0
Oracle Corporation Oracle Hyperion Data Relationship Management: before 11.2.8.0 — fixed in 11.2.8.0
Oracle Corporation Oracle Hyperion Infrastructure Technology: before 11.2.8.0 — fixed in 11.2.8.0
Oracle Identity Management Suite: 12.2.1.3.0, 12.2.1.4.0
Oracle Corporation Oracle Identity Manager Connector: 11.1.1.5.0
Oracle Corporation Oracle JDeveloper: 12.2.1.3.0
Oracle Middleware Common Libraries And Tools: 12.2.1.4.0
Oracle Corporation MySQL Enterprise Monitor: through 8.0.29
Oracle Retail Extract Transform And Load: 13.2.5
Oracle Corporation Tuxedo: 12.2.2.0.0
Oracle WebLogic Server: 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
Qos Reload4J: before 1.2.18.2 — fixed in 1.2.18.2

How to fix

Upgrade to a fixed version: Oracle Communications Offline Mediation Controller 12.0.0.4.4; Oracle E-Business Suite Cloud Manager And Cloud Backup Module 2.2.1.1.1; Oracle Corporation Oracle Hyperion Data Relationship Management 11.2.8.0; Oracle Corporation Oracle Hyperion Infrastructure Technology 11.2.8.0; Qos Reload4J 1.2.18.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-23305 or the next vulnerability affects your stack