CVE-2020-23302: 
Homebrew vulnerability analysis and mitigation

CVE-2022-23302 is a remote code execution vulnerability in Log4j 1.x when configured to use JMSSink. The vulnerability was discovered and reported by Google researchers Eduardo Vela, Maksim Shudrak, and Jacob Butler. The issue affects non-default configurations of Log4j 1.x versions (Red Hat Advisory, Sonatype Blog).

The vulnerability exists when the attacker has write access to the Log4j configuration or if the configuration references an attacker-controlled LDAP service. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution, similar to CVE-2021-4104. The vulnerability has been assigned a CVSS score of 7.2 (High) (Oracle Advisory).

If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code on the affected system when specific conditions are met, particularly in environments where Log4j 1.x is configured to use JMSSink (Sonatype Blog).

Since Log4j 1.x is end-of-life since August 2015, the recommended mitigation is to upgrade to a secure version of Log4j 2.x. Organizations should review their configurations and ensure they are not using JMSSink in their Log4j implementations (Sonatype Blog).