Vulnerability Description
In Apache Ofbiz, versions v17.12.01 to v17.12.07 implement a try catch exception to handle errors at multiple locations but leaks out sensitive table info which may aid the attacker for further recon. A user can register with a very long password, but when he tries to login with it an exception occurs.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Ofbiz | >= 17.12.01, < 17.12.08 |
Related Weaknesses (CWE)
References
- https://github.com/apache/ofbiz-framework/commit/2f5b8d33e32c4d9a48243cf9e503236PatchThird Party Advisory
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25958Third Party Advisory
- https://github.com/apache/ofbiz-framework/commit/2f5b8d33e32c4d9a48243cf9e503236PatchThird Party Advisory
- https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25958Third Party Advisory
FAQ
What is CVE-2021-25958?
CVE-2021-25958 is a vulnerability with a CVSS score of 6.5 (MEDIUM). In Apache Ofbiz, versions v17.12.01 to v17.12.07 implement a try catch exception to handle errors at multiple locations but leaks out sensitive table info which may aid the attacker for further recon....
How severe is CVE-2021-25958?
CVE-2021-25958 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-25958?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Ofbiz.