Description

Due to vulnerabilities in Log4j library used by Apache OFBiz, an unauthenticated attacker can leak sensitive information or execute arbitrary code on the system.

Remediation

Upgrade to the latest version of Apache OFBiz

References

Apache projects affected by log4j CVE-2021-44228

Related Vulnerabilities

PHP upload arbitrary file disclosure vulnerability

WordPress Plugin Paid Memberships Pro-Restrict Member Access to Content, Courses, Communities-Free or Paid Subscriptions Information Disclosure (2.5.2)

WordPress Plugin Breadcrumb NavXT Information Disclosure (6.1.0)

WordPress Plugin Save Contact Form 7 Information Disclosure (2.0)

WordPress Plugin MetaSlider Information Disclosure (3.3.1)

Severity

High

Classification

CVE-2021-44228 CWE-78 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A

Tags

Acumonitor Information Disclosure Code Execution