/
Security Advisory WSO2-2021-1720
com.atlassian.confluence.content.render.xhtml.migration.exceptions.UnknownMacroMigrationException: The macro 'next_previous_links' is unknown.

Security Advisory WSO2-2021-1720

Owned by Former user (Deleted)
Last updated: Mar 15, 2022

Published: 8th March 2022

Version: 1.0.0

Severity: Critical

CVSS Score:  10.0 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) 


AFFECTED PRODUCTS

WSO2 Integration Studio : 8.0.0 and Below


OVERVIEW

Log4j remote code execution zero-day vulnerability (CVE-2021-44228) - Log4j 2.17.0 update.


DESCRIPTION

Security advisory contents from Apache Log4j2 is as follows [1][2]:


"Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled."


This upgrade cumulatively mitigates known vulnerabilities of Log4j 2 prior to 2.17.0 relevant to the following dependencies:
  log4j-core upgraded to v2.17.0
  log4j-api upgraded to v2.17.0
  log4j-jcl upgraded to v2.17.0
  pax-logging-log4j2 to v1.11.12
  org.ops4j.pax.logging.pax-logging-log4j2 to v1.11.12


IMPACT

By leveraging the vulnerability, a malicious actor may perform Remote Code Execution by providing a crafted payload.


SOLUTION

The recommended solution is to migrate the latest version of WSO2 Integration Studio which is WSO2-Integration-Studio-8.0.1.

Related content

com.atlassian.confluence.content.render.xhtml.migration.exceptions.UnknownMacroMigrationException: The macro 'next_previous_links2' is unknown.