A high severity vulnerability (CVE-2021-44228) impacting multiple versions of the Apache Log4j2 utility was disclosed publicly on December 9, 2021. The vulnerability impacts Apache Log4j2 versions below 2.15.0. Find the details of this vulnerability documented here: https://logging.apache.org/log4j/2.x/security.html
ManageEngine products bundled with vulnerable Log4j2:
Product name | Jar version in bundled dependency |
ADManager Plus | V2.11.1 |
ADAudit Plus | V2.10.0 |
DataSecurity Plus | V2.10.0 |
EventLog Analyzer | V2.9.1 |
M365 Manager Plus | V2.11.1 |
RecoveryManager Plus | V2.11.1 |
Exchange Reporter Plus | V2.11.1 |
Log360 | V2.9.1 |
Log360 UEBA | V2.11.1 |
Cloud Security Plus | V2.9.1 |
Please note that we have not identified any exploitable cases due to Log4j2 in the above products as we do not use Log4j directly for logging. But, some of the third parties we use bundle Log4j2 as a dependency. So as an additional safety measure, customers are instructed to apply the mitigation steps listed below:
- ADManager Plus
- ADAudit Plus
- DataSecurity Plus
- EventLog Analyzer
- M365 Manager Plus
- RecoveryManager Plus
- Exchange Reporter Plus
- Log360
- Log360 UEBA (steps detailed in comments of ManageEngine PitStop post here)
- Cloud Security Plus (steps detailed in comments of ManageEngine PitStop post here)
*** Other ManageEngine products that are not listed above are not impacted by this vulnerability ***
We are continuing to analyze the issue and will update this advisory if any new information becomes available.For any additional details or assistance, please contact security@manageengine.com
This article is relevant to:
ManageEngineSecurity AdvisoryOther recent articles in the same category
You may be interested in these other recent articles
ManageEngine ServiceDesk Plus Cloud Build Release Information
25 July 2024
Summary details of the current Build Release information for ManageEngine ServiceDesk Plus Cloud Edition. All upgrades are performed by the Zoho Cloud team. Should you…
Read moreManageEngine Analytics Plus Build Release Information
23 July 2024
Summary details of the current build release information for ManageEngine Analytics Plus. Scroll the above to view more release details. Download the latest service packs…
Read moreManageEngine ADSelfService Plus Build Release Information
12 July 2024
The current build release information for ManageEngine ADSelfService Plus is summarised below. Scroll down for more information. You can download the latest service packs here.…
Read moreManageEngine Password Manager Pro Build Release Information
21 June 2024
The current build release information for ManageEngine Password Manager Pro is summarised below. Scroll down for more information. You can download the latest service packs…
Read moreSecurity Advisory – Important Security Fix Released For ManageEngine Solutions
17 June 2024
Product Name Affected Version(s) Fixed Version Fixed on Password Manager Pro 12430 and below 12431 14/06/2024 PAM360 7000 and below 7001 14/06/2024 DetailsAn SQL injection…
Read more