High severity8.8NVD Advisory· Published Apr 19, 2022· Updated Jun 17, 2026

CVE-2021-3100

Description

The Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.1-13 didn’t mimic the permissions of the JVM being patched, allowing it to escalate privileges.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Amazon/Log4jhotpatch
cpe:2.3:a:amazon:log4jhotpatch:*:*:*:*:*:*:*:*
Range: <1.1-13
Apache/log4j-cve-2021-44228-hotpatchllm-fuzzy
Range: <1.1-13
Amazon/log4j-cve-2021-44228-hotpatchcpe-rescue
Range: unspecified

Patches

Vulnerability mechanics

References

unit42.paloaltonetworks.com/aws-log4shell-hot-patch-vulnerabilitiesnvdExploitThird Party Advisory
alas.aws.amazon.com/AL2/ALAS-2021-1732.htmlnvdVendor Advisory
alas.aws.amazon.com/ALAS-2021-1554.htmlnvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000