CVE-2021-44228 Log4j 2 exploitation

[frankvanesch-]

Hi Community,

I do not know this is the right place to ask, but. 

Is the Microsoft-Power platform (Non-custom connectors, Canvas Apps, DAX etc?) vulnerable to this Log4j 2 Exploit? 

[hbd]

yes it's using log4j 2.12.1 in \Program Files (x86)\Power Automate Desktop\java-support\PAD.JavaBridge.jar, log4j 2.12.1

[esullivan]

I have found this file to be vulnerable as well:
C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_10.0.2290.0_x64__8wekyb3d8bbwe\java-support\PAD.JavaBridge.jar

C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_10.0.2290.0_x64__8wekyb3d8bbwe\java-support\PAD.JavaBridge.jar contains Log4J-2.x >= 2.10.0 _VULNERABLE

I have uninstalled Power Automate and the file remains