Medium severity6.6NVD Advisory· Published Dec 16, 2021· Updated Jun 17, 2026

CVE-2021-42550

Description

In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
ch.qos.logback:logback-coreMaven	< 1.2.9	1.2.9

Affected products

NetApp/Cloud Manager
cpe:2.3:a:netapp:cloud_manager:-:*:*:*:*:*:*:*
NetApp/Service Level Manager
cpe:2.3:a:netapp:service_level_manager:-:*:*:*:*:*:*:*
NetApp/Snap Creator Framework
cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*
Qos Ch/Logback12 versions
cpe:2.3:a:qos:logback:*:*:*:*:*:*:*:*+ 11 more
- cpe:2.3:a:qos:logback:*:*:*:*:*:*:*:*range: <=1.2.7
- cpe:2.3:a:qos:logback:1.3.0:alpha0:*:*:*:*:*:*
- cpe:2.3:a:qos:logback:1.3.0:alpha10:*:*:*:*:*:*
- cpe:2.3:a:qos:logback:1.3.0:alpha1:*:*:*:*:*:*
- cpe:2.3:a:qos:logback:1.3.0:alpha2:*:*:*:*:*:*
- cpe:2.3:a:qos:logback:1.3.0:alpha3:*:*:*:*:*:*
- cpe:2.3:a:qos:logback:1.3.0:alpha4:*:*:*:*:*:*
- cpe:2.3:a:qos:logback:1.3.0:alpha5:*:*:*:*:*:*
- cpe:2.3:a:qos:logback:1.3.0:alpha6:*:*:*:*:*:*
- cpe:2.3:a:qos:logback:1.3.0:alpha7:*:*:*:*:*:*
- cpe:2.3:a:qos:logback:1.3.0:alpha8:*:*:*:*:*:*
- cpe:2.3:a:qos:logback:1.3.0:alpha9:*:*:*:*:*:*
Red Hat/Satellite
cpe:2.3:a:redhat:satellite:6.0:*:*:*:*:*:*:*
Siemens Foundation/Sinec Nms
cpe:2.3:a:siemens:sinec_nms:*:*:*:*:*:*:*:*
Range: <1.0.3
ghsa-coords80 versions
pkg:maven/ch.qos.logback/logback-core pkg:rpm/opensuse/antlr3&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/antlr3-bootstrap&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/antlr3-java&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/maven&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/minlog&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/sbt&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/sbt-bootstrap&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/xmvn&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/xmvn-connector&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/xmvn-mojo&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/xmvn-parent&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/xmvn-tools&distro=openSUSE%20Leap%2015.4 pkg:rpm/suse/antlr3-java&distro=SUSE%20Manager%20Server%20Module%204.3 pkg:rpm/suse/maven&distro=SUSE%20Enterprise%20Storage%207 pkg:rpm/suse/maven&distro=SUSE%20Enterprise%20Storage%207.1 pkg:rpm/suse/maven&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSS pkg:rpm/suse/maven&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-ESPOS pkg:rpm/suse/maven&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS pkg:rpm/suse/maven&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP4 pkg:rpm/suse/maven&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2015%20SP3 pkg:rpm/suse/maven&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSS pkg:rpm/suse/maven&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS pkg:rpm/suse/maven&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2 pkg:rpm/suse/maven&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3 pkg:rpm/suse/minlog&distro=SUSE%20Enterprise%20Storage%207 pkg:rpm/suse/minlog&distro=SUSE%20Enterprise%20Storage%207.1 pkg:rpm/suse/minlog&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSS pkg:rpm/suse/minlog&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-ESPOS pkg:rpm/suse/minlog&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS pkg:rpm/suse/minlog&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP4 pkg:rpm/suse/minlog&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2015%20SP3 pkg:rpm/suse/minlog&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSS pkg:rpm/suse/minlog&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS pkg:rpm/suse/minlog&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2 pkg:rpm/suse/minlog&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3 pkg:rpm/suse/xmvn&distro=SUSE%20Enterprise%20Storage%207 pkg:rpm/suse/xmvn&distro=SUSE%20Enterprise%20Storage%207.1 pkg:rpm/suse/xmvn&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSS pkg:rpm/suse/xmvn&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-ESPOS pkg:rpm/suse/xmvn&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS pkg:rpm/suse/xmvn&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP4 pkg:rpm/suse/xmvn&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2015%20SP3 pkg:rpm/suse/xmvn&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSS pkg:rpm/suse/xmvn&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS pkg:rpm/suse/xmvn&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2 pkg:rpm/suse/xmvn&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3 pkg:rpm/suse/xmvn-connector&distro=SUSE%20Enterprise%20Storage%207 pkg:rpm/suse/xmvn-connector&distro=SUSE%20Enterprise%20Storage%207.1 pkg:rpm/suse/xmvn-connector&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSS pkg:rpm/suse/xmvn-connector&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-ESPOS pkg:rpm/suse/xmvn-connector&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS pkg:rpm/suse/xmvn-connector&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP4 pkg:rpm/suse/xmvn-connector&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2015%20SP3 pkg:rpm/suse/xmvn-connector&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSS pkg:rpm/suse/xmvn-connector&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS pkg:rpm/suse/xmvn-connector&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2 pkg:rpm/suse/xmvn-connector&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3 pkg:rpm/suse/xmvn-mojo&distro=SUSE%20Enterprise%20Storage%207 pkg:rpm/suse/xmvn-mojo&distro=SUSE%20Enterprise%20Storage%207.1 pkg:rpm/suse/xmvn-mojo&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSS pkg:rpm/suse/xmvn-mojo&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-ESPOS pkg:rpm/suse/xmvn-mojo&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS pkg:rpm/suse/xmvn-mojo&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP4 pkg:rpm/suse/xmvn-mojo&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2015%20SP3 pkg:rpm/suse/xmvn-mojo&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSS pkg:rpm/suse/xmvn-mojo&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS pkg:rpm/suse/xmvn-mojo&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2 pkg:rpm/suse/xmvn-mojo&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3 pkg:rpm/suse/xmvn-tools&distro=SUSE%20Enterprise%20Storage%207 pkg:rpm/suse/xmvn-tools&distro=SUSE%20Enterprise%20Storage%207.1 pkg:rpm/suse/xmvn-tools&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP2-LTSS pkg:rpm/suse/xmvn-tools&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-ESPOS pkg:rpm/suse/xmvn-tools&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS pkg:rpm/suse/xmvn-tools&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP4 pkg:rpm/suse/xmvn-tools&distro=SUSE%20Linux%20Enterprise%20Real%20Time%2015%20SP3 pkg:rpm/suse/xmvn-tools&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP2-LTSS pkg:rpm/suse/xmvn-tools&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS pkg:rpm/suse/xmvn-tools&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP2 pkg:rpm/suse/xmvn-tools&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3
< 1.2.9+ 79 more
- (no CPE)range: < 1.2.9
- (no CPE)range: < 3.5.3-150200.3.11.8
- (no CPE)range: < 3.5.3-150200.3.11.8
- (no CPE)range: < 3.5.3-150200.3.11.8
- (no CPE)range: < 3.8.6-150200.4.9.8
- (no CPE)range: < 1.3.1-150200.3.7.8
- (no CPE)range: < 0.13.18-150200.4.7.8
- (no CPE)range: < 0.13.18-150200.4.7.8
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.3
- (no CPE)range: < 4.0.0-150200.3.7.8
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 3.5.3-150200.3.11.8
- (no CPE)range: < 3.8.6-150200.4.9.8
- (no CPE)range: < 3.8.6-150200.4.9.8
- (no CPE)range: < 3.8.6-150200.4.9.8
- (no CPE)range: < 3.8.6-150200.4.9.8
- (no CPE)range: < 3.8.6-150200.4.9.8
- (no CPE)range: < 3.8.6-150200.4.9.8
- (no CPE)range: < 3.8.6-150200.4.9.8
- (no CPE)range: < 3.8.6-150200.4.9.8
- (no CPE)range: < 3.8.6-150200.4.9.8
- (no CPE)range: < 3.8.6-150200.4.9.8
- (no CPE)range: < 3.8.6-150200.4.9.8
- (no CPE)range: < 1.3.1-150200.3.7.8
- (no CPE)range: < 1.3.1-150200.3.7.8
- (no CPE)range: < 1.3.1-150200.3.7.8
- (no CPE)range: < 1.3.1-150200.3.7.8
- (no CPE)range: < 1.3.1-150200.3.7.8
- (no CPE)range: < 1.3.1-150200.3.7.8
- (no CPE)range: < 1.3.1-150200.3.7.8
- (no CPE)range: < 1.3.1-150200.3.7.8
- (no CPE)range: < 1.3.1-150200.3.7.8
- (no CPE)range: < 1.3.1-150200.3.7.8
- (no CPE)range: < 1.3.1-150200.3.7.8
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.3
- (no CPE)range: < 4.0.0-150200.3.7.3
- (no CPE)range: < 4.0.0-150200.3.7.3
- (no CPE)range: < 4.0.0-150200.3.7.3
- (no CPE)range: < 4.0.0-150200.3.7.3
- (no CPE)range: < 4.0.0-150200.3.7.3
- (no CPE)range: < 4.0.0-150200.3.7.3
- (no CPE)range: < 4.0.0-150200.3.7.3
- (no CPE)range: < 4.0.0-150200.3.7.3
- (no CPE)range: < 4.0.0-150200.3.7.3
- (no CPE)range: < 4.0.0-150200.3.7.3
- (no CPE)range: < 4.0.0-150200.3.7.8
- (no CPE)range: < 4.0.0-150200.3.7.8
- (no CPE)range: < 4.0.0-150200.3.7.8
- (no CPE)range: < 4.0.0-150200.3.7.8
- (no CPE)range: < 4.0.0-150200.3.7.8
- (no CPE)range: < 4.0.0-150200.3.7.8
- (no CPE)range: < 4.0.0-150200.3.7.8
- (no CPE)range: < 4.0.0-150200.3.7.8
- (no CPE)range: < 4.0.0-150200.3.7.8
- (no CPE)range: < 4.0.0-150200.3.7.8
- (no CPE)range: < 4.0.0-150200.3.7.8
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
- (no CPE)range: < 4.0.0-150200.3.7.1
QOS.ch/logbackv5
Range: unspecified

Patches

Vulnerability mechanics

References

packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.htmlnvdExploitThird Party AdvisoryVDB EntryWEB
jira.qos.ch/browse/LOGBACK-1591nvdExploitIssue TrackingPatchThird Party AdvisoryWEB
logback.qos.ch/news.htmlnvdVendor AdvisoryWEB
seclists.org/fulldisclosure/2022/Jul/11nvdMailing ListThird Party AdvisoryWEB
cert-portal.siemens.com/productcert/pdf/ssa-371761.pdfnvdThird Party AdvisoryWEB
github.com/advisories/GHSA-668q-qrv7-99fmghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2021-42550ghsaADVISORY
security.netapp.com/advisory/ntap-20211229-0001/nvdThird Party Advisory
github.com/qos-ch/logback/blob/1502cba4c1dfd135b2e715bc0cf80c0045d4d128/logback-site/src/site/pages/news.htmlghsaWEB
github.com/qos-ch/logback/commit/87291079a1de9369ac67e20dc70a8fdc7cc4359cghsaWEB
github.com/qos-ch/logback/commit/ef4fc4186b74b45ce80d86833820106ff27edd42ghsaWEB
security.netapp.com/advisory/ntap-20211229-0001ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.429
epss	0.004
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000