What’s Vulnerable › Vulnerabilities

CVE-2021-25958: Generation of Error Message Containing Sensitive Information in Apache OFBiz

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-08-30 · updated 2026-06-17
• Weakness: CWE-209

Description

In Apache Ofbiz, versions v17.12.01 to v17.12.07 implement a try catch exception to handle errors at multiple locations but leaks out sensitive table info which may aid the attacker for further recon. A user can register with a very long password, but when he tries to login with it an exception occurs.

Affected products

• Apache Software Foundation Apache OFBiz: from 17.12.01 before 17.12.08 — fixed in 17.12.08

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache OFBiz 17.12.08. Check the vendor advisory for mitigations.

References

• https://github.com/apache/ofbiz-framework/commit/2f5b8d33e32c4d9a48243cf9e503236acd5aec5c
• https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25958
• https://github.com/apache/ofbiz-framework/commit/2f5b8d33e32c4d9a48243cf9e503236acd5aec5c
• https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25958

Get alerted when CVE-2021-25958 or the next vulnerability affects your stack