Forum Discussion
Proof-of-Concept for Critical Apache Log4j Remote Code...
Proof-of-Concept for Critical Apache Log4j Remote Code Execution Vulnerability Available (CVE-2021-44228) On December 9, researchers published proof-of-concept (PoC) exploit code for a critical vuln...
Same issue here, Keith, I'm confused why there's not a plugin for unauthenticated scans since that's exactly how attackers are scanning for vulnerable hosts...
Just forced plugin updates and not seeing them when I search either.
I manually "updated" the feeds for Tenable.SC and Active Plugins from within my on-prem SC instance. The plugin IDs were then searchable in the "Plugins" page under the username dropdown menu. That's how I found which were local and which were encrypted.
Waiting on hold for a support engineer, but my hope is that 155998 "Apache Log4j Message Lookup Substitution RCE (Log4Shell) (Direct Check)" is a remote check, as most of the previous "Direct Check" plugins for similar vulns are remote type.