CVE / KEV 查詢
輸入 CVE 編號，即可在一個頁面查看嚴重程度（CVSS）、被利用機率（EPSS）、是否正在被實際利用（CISA KEV）以及修復線索。優先讀取本站自有的情報來源資料庫，沒有時再從 NVD/FIRST 取得。
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
- http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.htmlBroken Link
- https://www.nu11secur1ty.com/2021/12/cve-2021-44228.htmlExploit
- http://www.openwall.com/lists/oss-security/2021/12/13/2Mailing List
- http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.htmlThird Party Advisory
- http://seclists.org/fulldisclosure/2022/Jul/11Mailing List
- https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdfThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/Release Notes
- http://www.openwall.com/lists/oss-security/2021/12/14/4Mailing List
- https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdfThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/12/10/2Mailing List
- http://seclists.org/fulldisclosure/2022/Dec/2Exploit
- https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228Exploit
使用方法
- 1
輸入您關注的 CVE 編號（範例：CVE-2021-44228）。
- 2
頁面會顯示 CVSS、EPSS、KEV（是否正在被利用）以及修復線索。
- 3
透過「本站的解讀文章」或「NVD 官方」頁面進一步了解詳情。
為什麼重要
常見問題
Q什麼是 KEV？
這是美國 CISA 發布的《已確認被實際利用的漏洞》目錄。被收錄進 KEV＝攻擊正在現實中發生，是應當最優先處理的對象。
QEPSS 和 CVSS 有何區別？
CVSS 是漏洞的「嚴重程度」，EPSS 是「未來 30 天內被利用的機率」。嚴重程度高的漏洞被利用機率也可能很低，兩者結合才能務實地確定優先級。
Q任何 CVE 都能查詢嗎？
本站資料庫中收錄的 KEV 漏洞會立即顯示詳情；其他 CVE 只要在 NVD 中有登錄，也會即時取得並顯示（此時 KEV 顯示為「未收錄」）。