Does that mean it's only vulnerable if JMSAppender is used otherwise not? Which should at least be a rarer use case.