vulnerability Output Best Practice
This is an example of vulnerability analysis output generated in 05 Tools Chapter.
You can check actual output examples based on sample projects (including java-vulnerable, Log4Shell CVE-2021-44228).
vulnerability analysis report
generating agent:
05-vulnerability-analyst| Save Path:output/vulnerability/cve-report.md
Report Type: vulnerability Analysis Creation Date: YYYY-MM-DD Target project: your-project Tools used: OSV API
1. Summary
- SBOM Analysis object:
your-project.cdx.json(CycloneDX) - A total of 5 vulnerabilities discovered — 🔴 2 Critical, 🟠 High 1, 🟡 Medium 2
- Immediate action required Critical vulnerabilities (CVE-2021-44228, CVE-2021-45046) confirmed in
log4j-core 2.14.1 - Recommended Action: Immediately upgrade
log4j-coreandlog4j-apito 2.17.1 or later
2. vulnerability details
| component | version | CVE | CVSS | Severity | Description | modified version |
|---|---|---|---|---|---|---|
| log4j-core | 2.14.1 | CVE-2021-44228 | 10.0 | 🔴 Critical | Log4Shell: Remote Code Execution (RCE) via JNDI | 2.15.0+ |
| log4j-core | 2.14.1 | CVE-2021-45046 | 9.0 | 🔴 Critical | 2.15.0 Patch incomplete — bypassable in non-default settings | 2.16.0+ |
| log4j-core | 2.14.1 | CVE-2021-45105 | 7.5 | 🟠 High | DoS due to Thread Context Map self-reference | 2.17.0+ |
| log4j-core | 2.14.1 | CVE-2021-44832 | 6.6 | 🟡 Medium | RCE is possible if you have permission to modify logging settings | 2.17.1+ |
| log4j-core | 2.14.1 | CVE-2025-68161 | 5.4 | 🟡 Medium | Socket Appender TLS host name verification not performed | 2.25.3+ |
3. Measures
Immediate action (Critical — within 24 hours)
Upgrade to log4j-core 2.17.1 or higher — All Critical/High vulnerabilities resolved simultaneously
<!-- pom.xml -->
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
<version>2.17.1</version>
</dependency>
ISO/IEC 18974 §4.3.2 Criteria — Known vulnerability Identification, CVE Risk Scoring (CVSS), vulnerability Tracking and Health Management
vulnerability Response Plan (Remediation Plan)
generating agent:
05-vulnerability-analyst| Save Path:output/vulnerability/remediation-plan.md
Report Type: vulnerability Response Plan Creation date: YYYY-MM-DD Target project: your-project
outline
| Item | Content |
|---|---|
| Response Standards | ISO/IEC 18974 §4.3.2 |
| Total number of vulnerabilities | 5 (Critical 2, High 1, Medium 2) |
| Subject to immediate action | CVE-2021-44228, CVE-2021-45046 |
Step-by-step response plan
Phase 1 — Immediate action (Critical, within 24 hours)
- Remove JndiLookup class (emergency mitigation before upgrade)
- Upgrade to log4j-core 2.17.1
- Build and run regression tests
- Investigation of infringement history (search for
${jndi:pattern in logs)
Phase 2 — Short-term action (High, within 7 days)
| work | Contact person | Deadline |
|---|---|---|
| Complete survey of operating server log4j versions | Infrastructure Manager | D+2 |
| Apply patches to all operating environments | Infrastructure Manager | D+4 |
| Run full regression test | QA Manager | D+6 |
| Create a patch completion report | Security Manager | D+7 |
Phase 3 — Medium-term measures (Medium, within 30 days)
| work | Details |
|---|---|
| Latest version upgrade evaluation | Check API compatibility, verify test environment |
| CI/CD vulnerability Scan Integration | Add Trivy or OWASP Dependency-Check Pipeline |
| SBOM Auto-generated integration | Automatic SBOM updates and vulnerability notifications when building |
vulnerability status tracking
| CVE | Severity | Current status | Goal Status | Contact person |
|---|---|---|---|---|
| CVE-2021-44228 | 🔴 Critical | No action | resolve | Security Manager |
| CVE-2021-45046 | 🔴 Critical | No action | resolve | Security Manager |
| CVE-2021-45105 | 🟠 High | No action | resolve | Infrastructure Manager |
| CVE-2021-44832 | 🟡 Medium | No action | resolve | Development Manager |
| CVE-2025-68161 | 🟡 Medium | No action | resolve | Development Manager |
How to update status: After applying the patch, update to “No action” → “Resolved (YYYY-MM-DD)”
Measures to prevent recurrence
| cycle | work |
|---|---|
| At every build | Automatically scan for vulnerabilities in CI/CD |
| monthly | Check SBOM renewal and new CVE |
| branch | Dependency Full Upgrade Review |
| Annual | Full review of vulnerability management process |
This document is an official vulnerability response plan created to fulfill ISO/IEC 18974 §4.3.2 requirements.