Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2021-25958

Generation of Error Message Containing Sensitive Information in Apache OFBiz

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Mend

Description

In Apache Ofbiz, versions v17.12.01 to v17.12.07 implement a try catch exception to handle errors at multiple locations but leaks out sensitive table info which may aid the attacker for further recon. A user can register with a very long password, but when he tries to login with it an exception occurs.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

apache ofbiz-framework

  • v17.12.01 to < unspecifiedaffected
  • unspecified to ≤ v17.12.07affected

References