Log4j Announcement

Log4j Announcement - December 14, 2021

Acceptto is aware of the Log4j vulnerability announced on December 9th. Information about a critical unauthenticated RCE vulnerability (CVE-2021-44228) that affects Java logging package log4j was tweeted, and a proof-of-concept (PoC) were posted on GitHub. This vulnerability could allow attackers full control of the affected server if a user-controlled string is logged. Since it is so easily exploited, the impact of this vulnerability is severe. The vulnerability is already being actively exploited in the wild.

Neither of the Acceptto products, It’sMe mobile app and eGuardian, are using the Log4j module. There is no action required by our customers.

Bil Harmer CISSP, CISM, CIPP
CISO & Chief Evangelist | SecureAuth
secureauth.com | 650.303.9638