AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

OktaOKTA-0DA63XT

Okta On-Prem MFA Agent

Okta

CVE-2021-44228 · Published Jan 26, 2022

Critical10.0
No fix yet
Okta advisory

Apache Log4j2 <=2.14.1, as used in Okta On-Prem MFA Agent (formerly Okta RSA SecurID Agent) prior to 1.4.6, does not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers.

Affected versions

The source does not list versions here. See the source advisory for affected products and fixes.

Changes since it was listed

SeverityOct 17Severity: Unrated to Critical
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity from
NVD

More Okta advisories

All Okta
Low 3.9Sep 1, 2022Okta Active Directory AgentCVE-2022-1697no fix yetHigh 8.8Mar 21, 2022Okta Advanced Server Access ClientCVE-2022-1030no fix yetHigh 8.8Feb 17, 2022Okta Advanced Server Access ClientCVE-2022-24295no fix yetMedium 5.9Jan 26, 2022Okta RADIUS Server AgentCVE-2021-45105no fix yetCritical 9.0Jan 26, 2022Okta On-Prem MFA AgentCVE-2021-45046no fix yetCritical 9.0Jan 26, 2022Okta RADIUS Server AgentCVE-2021-45046no fix yet