XPP: Log4j vulnerability impact on XPP versions

Article Number:000017738 | Last Updated:1/10/2024 3:52 AM

Scope/Environment

XPP

Question

Is XPP affected by CVE-2021-44228, CVE-2021-45046 or CVE-2021-45105 log4j security vulnerability?

Answer

No, XPP, XPP RESTful Web Services and XPP Web Services (SOAP) do not utilize log4j.

XPP Web Services (soap) does deliver a log4j-1.2.8.jar file to the installed Tomcat folder under \webapps\xppws\WEB-INF\lib but it is not used with the product as delivered.

To mitigate any vulnerability, this file can safely be removed from the system with no adverse effects.

Reference

Send Article Feedback