Hi, can IFS please provide a notice on whether IFS Applications 10 (inc. MWO, and Aurena) are vulnerable to the Log4J2 CVE-2021-44228?
This topic has been closed for comments
+1
Any comments from IFS regarding this?
Yes, eagerly awaiting an update. I came across POC on Twitter which suggested WebLogic is vulnerable so we’ve locked things down until IFS provide an update.
Hi
Thanks,
Mick.
We turned off all internet accessibility to our environments so they are only accessible on the corporate network directly. That way it’s impossible for the module to be called outside our network.
They are behind a reverse proxy and firewall etc. but obviously they are unlikely to help with this vuln.
By turning off internet access it means that we’ve lost the use of MWO and Aurena in the field for our maintenance team unless they’re on corporate wi-fi, and contractors now will have to use the terminal server.
This is all in addition to other network-wide mitigations too of course.
Userlevel 7
+17
Please subscribe to this KBA which will be updated every 24 hours
Enter your username or e-mail address. We'll send you an e-mail with instructions to reset your password.