CVE-2021-3100

HIGH 8.8CVE-2021-3100 · Published 19/04/2022 · updated 17/06/2026

In short

CVE-2021-3100 is a HIGH (CVSS 8.8) vulnerability affecting log4jhotpatch (amazon).
Chance of exploitation in the next 30 days (EPSS): 0.37%, higher than 30.5% of all vulnerabilities.
Fix: update to 1.1-13 or later.

Package	Affected versions	Patched versions
log4jhotpatch amazon	`< 1.1-13`	`1.1-13`

Description

The Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.1-13 didn’t mimic the permissions of the JVM being patched, allowing it to escalate privileges.

References

alas.aws.amazon.com/AL2/ALAS-2021-1732.html · Vendor Advisory
alas.aws.amazon.com/ALAS-2021-1554.html · Vendor Advisory
unit42.paloaltonetworks.com/aws-log4shell-hot-patch-vulnerabilities · Exploit

More vulnerabilities in log4jhotpatch

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free