Overview
The Apache Log4j software has made headlines recently with multiple vulnerabilities, including the Log4Shell exploit. This threat is currently being traced by NIST as CVE-2021-4428. We have had multiple inquiries as to if our products are vulnerable due to this exploit.
None of Cloud Retailers applications (Back Office, Point of Sale, Mobile) make use of the Java programming language, nor do we utilize the Apache web server platform (including Tomcat) within our infrastructure.
We have reviewed any other software within our environment, not connected to Cloud Retailer and found no open attack vectors. Even still, as an abundance of caution we are putting into place mitigation strategies outlined here: Apache Log4j Vulnerability Guidance.
References
- [NIST] CVE-2021-4428
- [CISA] Apache Log4j Vulnerability Guidance
Was this article helpful?
That’s Great!
Thank you for your feedback
Sorry! We couldn't be helpful
Thank you for your feedback
Feedback sent
We appreciate your effort and will try to fix the article