CVE-2021-25958 Generation of Error Message Containing Sensitive Information in Apache OFBiz
Apache OFBiz leaks sensitive table information in error messages during login failures, aiding attacker reconnaissance.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-25958?
CVE-2021-25958 is a medium-severity vulnerability in Apache Ofbiz, published on 30 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Apache Ofbiz, versions v17.12.01 to v17.12.07 implement a try catch exception to handle errors at multiple locations but leaks out sensitive table info which may aid the attacker for further recon. A user can register with a very long password, but when he tries to login with it an exception occurs.
Weakness: CWE-209
Which versions are affected by CVE-2021-25958?
It affects 1 product.
Products include Apache Ofbiz.
How do I fix CVE-2021-25958?
No fix has been published for CVE-2021-25958 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-25958 being exploited?
There is no known exploitation of CVE-2021-25958 in the wild and no public exploit code.
Other vulnerabilities in Apache Ofbiz
- CVE-2024-45195 Apache OFBiz Forced Browsing
- CVE-2024-32113 Apache OFBiz Path Traversal
- CVE-2024-38856 Apache OFBiz Incorrect Authorization
- CVE-2013-2250 Code injection in n/a
- CVE-2012-3506 Unspecified vulnerability in the Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.03 has unknown impact and attack vectors.
Sources
Also known as GHSA-4xjx-qw73-2v8v.