Question

During a credentialed authenticated scan of a client's Linux web server, your scanner flags CVE-2021-44228 (Log4Shell) as a high-severity finding based on the Apache HTTP Server banner. Before including it in your report, you must validate whether it is a true positive. Which action provides the strongest evidence that this finding is a false positive?

Accepted Answer

Send a crafted JNDI lookup string to the application and monitor an attacker-controlled listener for an inbound callback that never arrives, while confirming no Java/Log4j components are deployed on the host

Answer

Compare the reported version banner against the version the scanner claims is vulnerable and confirm they match

Answer

Re-run the same scan a second time with the same plugin set to see if the finding reappears

Answer

Check the CVSS base score of CVE-2021-44228 and note that it is 10.0, indicating the finding is likely genuine