Log4j Vulnerability, Log4shell, Exploit, Web Attack.
can access the attacker-controlled service to load the malicious Java class. So yes, there is a potentially higher risk for internal applications when all of the above prerequisites are met. Mitigations As can be read everywhere: Patch any application using Apache log4j 2.x to at least version