A new remote code execution (RCE) vulnerability has been discovered in Apache log4j 2.17.0, tracked as CVE-2021-44832, this vulnerability is rated "Moderate" in severity.

The vulnerability stems from the lack of additional controls on JDNI access in log4j2. By making use of JDBC Appender with a data source referencing a JNDI URI, an attacker with access to logging configuration file can build a malicious configuration which execute remote code on affected system. 

Table 1: Vulnerability details 

                                                                       Table 2: Vulnerable versions