CVE-2021-25958

Katalog CVE

CVSS 7.5 · High EPSS 2,6%

Kerentanan Generation of Error Message Containing Sensitive Information pada apache ofbiz. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

In Apache Ofbiz, versions v17.12.01 to v17.12.07 implement a try catch exception to handle errors at multiple locations but leaks out sensitive table info which may aid the attacker for further recon. A user can register with a very long password, but when he tries to login with it an exception occurs.

Rincian

Terbit di NVD

30 Agustus 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-209: Generation of Error Message Containing Sensitive Information

EPSS (30 hari)

2,6% peluang dieksploitasi; lebih tinggi dari 85,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/apache/ofbiz-framework/commit/2f5b8d33e32c4d9a48243cf9e503236acd5aec5c patch · advisory pihak ketiga
• https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25958 advisory pihak ketiga