Attackers can directly construct malicious requests to trigger remote code execution vulnerabilities. Vulnerability exploitation does not require special configuration, Apache Struts2, Apache Solr, Apache Druid, Apache Flink, etc. are all affected

Ref: https://github.com/tangxiaofeng7/apache-log4j-poc