# CVE-2021-44228 Log4Shell

> Cascade CMS is not affected by CVE-2021-44228 (Log4Shell), because the log4j message lookup substitution feature the exploit depends on is disabled or unsupported in our implementation.

URL: https://www.hannonhill.com/cascadecms/latest/articles/cascade-administration/security-advisories/cve-2021-44228-log4shell.html
category: Cascade Administration
article-type: reference
content-kind: faq
release-availability: all
tags: security
updated: 2026-10-06

> **Not affected**
>
> Cascade Cloud (as of 3/8/2022) and on-premise Cascade CMS are not affected by CVE-2021-44228. No action is required.

## What is CVE-2021-44228 (Log4Shell)?

In summary:

> Log4j versions prior to 2.15.0 are subject to a remote code execution vulnerability via the ldap JNDI parser. As per [Apache's Log4j security guide](https://logging.apache.org/log4j/2.x/security.html): Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default.

## Is Cascade CMS affected by CVE-2021-44228 (Log4Shell)?

[CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) does not impact Cascade Cloud as of 3/8/2022 or on-premise Cascade CMS 8.20, because the latest version of Log4j 2.x is in use, which disables the affected JNDI functionality by default.

Note that application logging configuration is not available within the application itself. It can only be customized with direct access to the application server.

### On-premise distributions older than Cascade CMS 8.20

For on-premise distributions, the vulnerability depends on the availability of a log4j feature called [message lookup substitution](https://logging.apache.org/log4j/2.x/manual/lookups.html), which is not supported in Cascade CMS's implementation of log4j. The most serious part of the vulnerability — the loading of classes from an arbitrary URL in JNDI — is also mitigated by the version of Java that ships with Cascade CMS, where `com.sun.jndi.ldap.object.trustURLCodebase` defaults to false.

### Related advisories

- [CVE-2021-4104](https://www.hannonhill.com/cascadecms/latest/articles/cascade-administration/security-advisories/cve-2021-4104.html) — a less serious variation, also mitigated in Cascade CMS.
- [CVE-2021-45046](https://www.hannonhill.com/cascadecms/latest/articles/cascade-administration/security-advisories/cve-2021-45046-log4shell.html) and [CVE-2021-45105](https://www.hannonhill.com/cascadecms/latest/articles/cascade-administration/security-advisories/cve-2021-45105-log4shell.html) — two later and less serious variations, both mitigated for the same reasons above.