CVE-2022-23302 Deserialization of untrusted data in JMSSink in Apache Log4j 1.x

What is CVE-2022-23302?

CVE-2022-23302 is a high-severity unsafe deserialization vulnerability in Broadcom Brocade Sannav, published on 18 Jan 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

Weakness: CWE-502

Which versions are affected by CVE-2022-23302?

4 open source packages ship an affected version, including log4j:log4j and org.zenframework.z8.dependencies.commons:log4j-1.2.17. It affects 26 products.

Products include Apache Log4j, Broadcom Brocade Sannav, Netapp Snapmanager, Oracle Advanced Supply Chain Planning, Oracle Business Intelligence, Oracle Business Process Management Suite and 20 more.

How do I fix CVE-2022-23302?

Product is end of life, replace it.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2022-23302 being exploited?

There is no known exploitation of CVE-2022-23302 in the wild and no public exploit code.

Other vulnerabilities in Broadcom Brocade Sannav

• CVE-2021-44228 Apache Log4j2 Remote Code Execution Exploited Critical 10.0
• CVE-2021-45046 Apache Log4j2 Deserialization of Untrusted Data Exploited Critical 9.0
• CVE-2022-23305 SQL injection in JDBC Appender in Apache Log4j V1 Critical 9.8
• CVE-2017-5645 Deserialization of Untrusted Data in Log4j Critical 9.8
• CVE-2023-26464 Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender High 7.5

All Broadcom Brocade Sannav vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLEANSTART-2026-VM68422, CLSA-2026-1787932767, DEBIAN-CVE-2022-23302, GHSA-w9p3-5cr8-m3jj, MINI-mjcc-h5m5-cqh5, MINI-wq68-jfxv-2cxv and 2 more.