Detections
Analytics
SCA: SQL Injection in Log4j 1.2.x (GHSA-65fg-84f6-3jq3)
critical Tenable Self-Hosted Container Security Plugin ID 433388
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the
values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be
included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or
headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue
only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default.
Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized
SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of
life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the
previous versions. (CVE-2022-23305)
See Also
Plugin Details
Severity: Critical
ID: 433388
Version: Revision 1.3
Type: Local
Family: SCA Checks
Published: 9/19/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.88
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2022-23305
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 1/22/2022
Reference Information
CVE: CVE-2022-23305