If someone/something can affect what is sent to/processed by your instance of log4j, then your code is vulnerable. It is important to understand that Log4j have more to do with java than 'web servers': - Some web servers might use log4j, but most don't use it as a standard component/module. - Log4j is a very popular module for logging purposers when using java.