Communications Network Integrity

Vendor:

First CVE: Apr 17, 2017 · Active for 9 years

24

Total CVEs

More Total CVEs than 95% of tracked products

4.8

Avg CVEs / Year

Higher CVE frequency than 87% of tracked products

7.8

Avg CVSS

Higher Avg CVSS than 63% of tracked products

0.0%

KEV Rate

Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Communications Network Integrity over time

Volume of CVEsAvg CVSS Base Score

First CVE

Apr 17, 2017

9 years ago

Most Recent CVE

Jan 18, 2022

1,647 days ago

CVE Severity & Scoring

Communications Network Integrity24 CVEs

38%

42%

21%

All CVEs352,101 CVEs

45%

40%

11%

MediumHighCritical

Attack Vector

Local1 (4.2%)

Network22 (91.7%)

Unknown0 (0.0%)

Physical0 (0.0%)

Adjacent Network1 (4.2%)

Attack Complexity

Low19 (79.2%)

High5 (20.8%)

Unknown0 (0.0%)

User Interaction

None16 (66.7%)

Unknown0 (0.0%)

Required8 (33.3%)

Privileges Required

Low6 (25.0%)

High0 (0.0%)

None18 (75.0%)

Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (24 CVEs).

24 CVEs · Highest risk first

CVE	Published	CVSS	Risk	KEV	Exploit
CVE-2019-2729CRITICAL Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and	Jun 19, 2019	9.8	89	NO	YES
CVE-2017-5645CRITICAL In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payloa	Apr 17, 2017	9.8	86	NO	YES
CVE-2019-0227HIGH A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projec	May 1, 2019	7.5	82	NO	YES
CVE-2021-45105MEDIUM Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker wit	Dec 18, 2021	5.9	76	NO	NO
CVE-2019-17571CRITICAL Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a	Dec 20, 2019	9.8	72	NO	NO
CVE-2021-4104HIGH JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName	Dec 14, 2021	7.5	70	NO	NO
CVE-2022-23305CRITICAL By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message conv	Jan 18, 2022	9.8	68	NO	NO
CVE-2022-23302HIGH JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration refere	Jan 18, 2022	8.8	63	NO	NO
CVE-2022-23307HIGH CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exi	Jan 18, 2022	8.8	57	NO	NO
CVE-2020-13936HIGH An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet c	Mar 10, 2021	8.8	40	NO	NO

View all 24 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (24 CVEs).

CISA KEV

0 CVEs

0.0% of CVEs· Bottom 1%

Metasploit

0 CVEs

0.0% of CVEs· Bottom 1%

Nuclei

3 CVEs

12.5% of CVEs· 97th percentile

ExploitDB

2 CVEs

8.3% of CVEs· 88th percentile

Social Chatter

Signals from CVEs in this product scope (24 CVEs).

Media Mentions

Signals from CVEs in this product scope (24 CVEs).

Top CNAs Publishing CVEs For Communications Network Integrity

Top CWEs

Versions

Version	CVE Count	Avg CVSS	Avg EPSS	Exploits
7.3.6	17	7.3	31.6%	2
7.3.5	8	6.7	14.0%	1
7.3.2	3	6.5	2.7%	0