Spring4Shell (CVE-2022-22965) has dominated the information security news these last six days, but Log4Shell (CVE-2021-44228) continues to demand attention and action from enterprise defenders as diverse vulnerable applications are being targeted in attacks in the wild.
Attackers in the wild exploiting Log4Shell
Log4Shell is widespread because Apache Log4j – the logging library that it affects – is widely used. While its exploitability depends on the Java version, the Log4j version (only Log4j v2 is vulnerable) and how it’s used, the vulnerability is easily triggered with the right exploit.
