> Why are people still using JDNI? Because "java:comp/env" is the way for a J2EE web application to get values or objects from the configuration outside its co

> Why are people still using JDNI? Because "java:comp/env" is the way for a J2EE web application to get values or objects from the configuration outside its container. Yes, nobody actually uses the remote parts of JNDI anymore, but the local variant (within the same process) is still in use. And that's what led to this vulnerability: someone wanted to be able to get these local values within the logging configuration, which is a valid use case. Not realizing that this opened the door to remote values and objects.