PT-2021-16882 · Apache · Apache Ofbiz

Daniel Elkabes + 1 · Published 2021-08-30 · Updated 2021-09-02 · CVE-2021-25958

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Ofbiz versions v17.12.01 through v17.12.07

Description The issue in Apache Ofbiz involves the implementation of a try-catch exception to handle errors at multiple locations, which results in leaking sensitive table information. This could aid an attacker in further reconnaissance. A user can register with a very long password, but attempting to log in with it causes an exception to occur.

Recommendations For Apache Ofbiz versions v17.12.01 through v17.12.07, consider restricting the length of passwords to prevent exceptions that could leak sensitive information. As a temporary workaround, consider disabling the registration feature with very long passwords until a patch is available. Restrict access to sensitive table information to minimize the risk of exploitation.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2021-25958

Affected Products

Apache Ofbiz

References · 6

• https://github.com/apache/ofbiz-framework/commit/2f5b8d33e32c4d9a48243cf9e503236acd5aec5c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-25958 · Security Note
• https://osv.dev/vulnerability/CVE-2021-25958 · Vendor Advisory
• https://t.me/cvenotify/20575 · Telegram Post
• https://whitesourcesoftware.com/vulnerability-database/CVE-2021-25958 · Note
• https://t.me/cibsecurity/28010 · Telegram Post