# CVE-2021-4104

> Cascade CMS is not affected by CVE-2021-4104, the Log4j 1.x JMSAppender remote code execution flaw, plus steps for removing the affected class from older on-premise distributions.

URL: https://www.hannonhill.com/cascadecms/latest/articles/cascade-administration/security-advisories/cve-2021-4104.html
category: Cascade Administration
article-type: reference
content-kind: faq
release-availability: all
tags: security
updated: 2026-10-06

> **Not affected**
>
> Cascade Cloud (as of 3/8/2022) and on-premise Cascade CMS are not affected by CVE-2021-4104. Optional hardening steps for older on-premise distributions are below.

## What is CVE-2021-4104?

In summary:

> A flaw was found in the Java logging library Apache Log4j in version 1.x. This allows a remote attacker to execute code on the server if the deployed application is configured to use JMSAppender. This flaw has been filed for Log4j 1.x; the corresponding flaw information for Log4j 2.x is available as CVE-2021-44228.

## Is Cascade CMS affected by CVE-2021-4104?

[CVE-2021-4104](https://access.redhat.com/security/cve/CVE-2021-4104) does not impact Cascade Cloud as of 3/8/2022 or on-premise Cascade CMS 8.20, because the latest version of Log4j 2.x is in use and is therefore not impacted by this particular vulnerability.

Note that application logging configuration is not available within the application itself. It can only be customized with direct access to the application server.

### On-premise distributions older than Cascade CMS 8.20

On-premise distributions of Cascade CMS are also not impacted *by default*. We do not make use of the affected `JMSAppender` in our distribution. That said, if Cascade CMS on-premise logging has been customized in any way, ensure the affected `JMSAppender` is not being used.

**Further mitigation**

You can take the additional step of removing the affected class from the log4j jar file. You'll need to do this for each and every upgrade until another solution exists.

To do this:

- Navigate to *tomcat/webapps* within the Cascade CMS home directory.
- You'll need to modify the log4j file not only in the unpacked *ROOT* directory but also in the bundled *ROOT.war*, if it exists.
-  For the unpacked version, navigate to *ROOT/WEB-INF/lib*. With access to the `zip` tool, you can run:
    ```bash
    $ zip -d log4j-1.2.17.jar org/apache/log4j/net/JMSAppender.class
        $ deleting: org/apache/log4j/net/JMSAppender.class
    ```
         If you don't have access to `zip`, you'll need to use something like the `jar` or `unzip` tool to unpack, remove the affected class, and repack it.
-  For the version bundled in the WAR file, unpack the WAR file to a temp directory from the *webapps* directory:
    ```bash
    $ mkdir temp
        $ cd temp
        $ jar xzf ../ROOT.war
    ```
         With access to the `zip` tool, you can run:
    ```bash
    $ zip -d WEB-INF/lib/log4j-1.2.17.jar org/apache/log4j/net/JMSAppender.class
        $ deleting: org/apache/log4j/net/JMSAppender.class
    ```
         Repack the WAR file. From inside the temp directory:
    ```bash
    jar cvf ROOT.war *
    ```
         Then replace the older one, keeping the original as a backup. From *webapps*:
    ```bash
    rm ROOT.war
        mv temp/ROOT.war .
        rm -rf temp
    ```

- Alternatively, if you haven't customized the unpacked WAR file, you can delete the entire *ROOT* directory, skip the first step, and make the modifications to *ROOT.war* only.

### Related advisories

This vulnerability is a less serious variation of [CVE-2021-44228](https://www.hannonhill.com/cascadecms/latest/articles/cascade-administration/security-advisories/cve-2021-44228-log4shell.html), which is also mitigated in Cascade CMS.