# CVE-2021-45105 Log4Shell

> Cascade CMS is not affected by CVE-2021-45105, the Log4j self-referential lookup denial of service, because message lookup substitution is disabled or unsupported in our use of log4j.

URL: https://www.hannonhill.com/cascadecms/latest/articles/cascade-administration/security-advisories/cve-2021-45105-log4shell.html
category: Cascade Administration
article-type: reference
content-kind: faq
release-availability: all
tags: security
updated: 2026-10-06

> **Not affected**
>
> Cascade Cloud (as of 3/8/2022) and on-premise Cascade CMS are not affected by CVE-2021-45105. No action is required.

## What is CVE-2021-45105 (Log4Shell)?

In summary:

> Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0 and 2.12.3.

## Is Cascade CMS affected by CVE-2021-45105 (Log4Shell)?

As was the case for [CVE-2021-44228](https://www.hannonhill.com/cascadecms/latest/articles/cascade-administration/security-advisories/cve-2021-44228-log4shell.html), [CVE-2021-45105](https://nvd.nist.gov/vuln/detail/CVE-2021-45105) does not impact Cascade Cloud (as of 3/8/2022) or on-premise Cascade CMS 8.20, because [message lookup substitution](https://logging.apache.org/log4j/2.x/manual/lookups.html) is disabled by default.

Note that application logging configuration is not available within the application itself. It can only be customized with direct access to the application server.

### On-premise distributions older than Cascade CMS 8.20

On-premise distributions do not support [message lookup substitution](https://logging.apache.org/log4j/2.x/manual/lookups.html) in their use of log4j; therefore, these versions of Cascade CMS are not affected.