What is CVE-2021-25958?

CVE-2021-25958 is a vulnerability in Apache Ofbiz versions v17.12.01 to v17.12.07 that leaks out sensitive table info, potentially aiding attackers in further recon.

How does CVE-2021-25958 impact Apache Ofbiz?

CVE-2021-25958 allows a user to register with a very long password, and when attempting to login with it, an exception occurs that exposes sensitive table information.

What is the severity of CVE-2021-25958?

CVE-2021-25958 has a severity rating of high, with a CVSS score of 7.5.

How can I mitigate CVE-2021-25958 in Apache Ofbiz?

To mitigate CVE-2021-25958, update your Apache Ofbiz version to 17.12.08 or later.

Where can I find more information about CVE-2021-25958?

You can find more information about CVE-2021-25958 in the Apache Ofbiz GitHub repository and the WhiteSource Software vulnerability database.

Vulnerability/
CVE-2021-25958

high

7.5

CWE

209

23/8/2021

3/8/2024

CVE-2021-25958: Generation of Error Message Containing Sensitive Information in Apache OFBiz

First published: Mon Aug 23 2021(Updated: )

In Apache Ofbiz, versions v17.12.01 to v17.12.07 implement a try catch exception to handle errors at multiple locations but leaks out sensitive table info which may aid the attacker for further recon. A user can register with a very long password, but when he tries to login with it an exception occurs.

Credit: vulnerabilitylab@mend.io

Affected Software	Affected Version	How to fix
Apache OFBiz	>=17.12.01<17.12.08

Remedy

https://github.com/apache/ofbiz-framework/commit/2f5b8d33e32c4d9a48243cf9e503236acd5aec5c

Remedy

Update to version release17.12.08

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is CVE-2021-25958?
CVE-2021-25958 is a vulnerability in Apache Ofbiz versions v17.12.01 to v17.12.07 that leaks out sensitive table info, potentially aiding attackers in further recon.
How does CVE-2021-25958 impact Apache Ofbiz?
CVE-2021-25958 allows a user to register with a very long password, and when attempting to login with it, an exception occurs that exposes sensitive table information.
What is the severity of CVE-2021-25958?
CVE-2021-25958 has a severity rating of high, with a CVSS score of 7.5.
How can I mitigate CVE-2021-25958 in Apache Ofbiz?
To mitigate CVE-2021-25958, update your Apache Ofbiz version to 17.12.08 or later.
Where can I find more information about CVE-2021-25958?
You can find more information about CVE-2021-25958 in the Apache Ofbiz GitHub repository and the WhiteSource Software vulnerability database.

collector/nvd-index
agent/references
agent/type
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/title
agent/remedy
agent/weakness
agent/severity
agent/author
agent/event
agent/description
agent/first-publish-date
agent/tags
agent/source
vendor/apache
canonical/apache ofbiz
version/apache ofbiz/17.12.01

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.