# CVE-2022-23307: Deserialization of Untrusted Data in Apache Log4j

Source: https://junglewise.ai/threats/cve-2022-23307-deserialization-of-untrusted-data-in-apache-log4j  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-01-19  
License: CC BY 4.0 with a link back

CVE-2022-23307 · Severity: low · CVSS 3.1 · Published 2022-01-19

Deserialization of Untrusted Data in Apache Log4j

Technologies: [log4j:log4j (Maven)](https://junglewise.ai/threats/technologies/log4j-log4j), [org.zenframework.z8.dependencies.commons:log4j-1.2.17 (Maven)](https://junglewise.ai/threats/technologies/org-zenframework-z8-dependencies-commons-log4j-1-2-17). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2022-23307 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-23307 being exploited in the wild.

**How severe is CVE-2022-23307?** Low severity, with a CVSS score of 3.1, published 19 January 2022.

**Which products and versions are affected?** log4j:log4j (Maven) ECOSYSTEM:introduced=0,last_affected=1.2.17; org.zenframework.z8.dependencies.commons:log4j-1.2.17 (Maven) ECOSYSTEM:introduced=0,last_affected=2.0.

**Is there a fix for CVE-2022-23307?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2022-23307?** Check whether you run log4j:log4j (Maven) or org.zenframework.z8.dependencies.commons:log4j-1.2.17 (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- log4j:log4j (Maven) ECOSYSTEM:introduced=0,last_affected=1.2.17
- org.zenframework.z8.dependencies.commons:log4j-1.2.17 (Maven) ECOSYSTEM:introduced=0,last_affected=2.0

## Identifiers

- CVE-2022-23307
- GHSA-f7vh-qwp3-x37m

## Related threats

- [Apache Log4j 1.x (EOL) allows Denial of Service (DoS)](https://junglewise.ai/threats/cve-2023-26464-apache-log4j-1-x-eol-allows-denial-of-service-dos)
- [Deserialization of Untrusted Data in Log4j 1.x](https://junglewise.ai/threats/cve-2022-23302-deserialization-of-untrusted-data-in-log4j-1-x)
- [Apache Log4j SQL injection in JDBCAppender](https://junglewise.ai/threats/cve-2022-23305-apache-log4j-sql-injection-in-jdbcappender)
- [JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data](https://junglewise.ai/threats/cve-2021-4104-jmsappender-in-log4j-1-2-is-vulnerable-to-deserialization-of)
- [Apache Log4j deserialization in SocketServer](https://junglewise.ai/threats/cve-2019-17571-apache-log4j-deserialization-in-socketserver)