Information about Log4J vulnerability
Incident
Report for Simployer
Resolved
This incident has been resolved.
Monitoring
On December 9, 2021, Apache disclosed that the Log4j utility contains a critical vulnerability that allows for unauthenticated remote code execution. Apache Log4j is a Java-based logging utility. The Log4j flaw – CVE-2021-44228 – is also known as Log4Shell or LogJam. This has impacted a significant number of servers across the internet, as it is commonly used by most Java installations. Read more (Norwegian National Security Authority):
https://nsm.no/fagomrader/digital-sikkerhet/nasjonalt-cybersikkerhetssenter/varsler-fra-ncsc/utvidet-oppdatering-for-apache-log4j-cve-2021-44228
Simployer HRM and Simployer Expert Help does not use Java. We do however use 3rd party vendors that could potentially be impacted by the vulnerability.
We take the security of our customers very seriously, and upon learning about the Log4j flaw we closely evaluated our solutions and confirmed that they do not use Log4j. After evaluating all of our 3rd party vendors we discovered that two of the products we use internally could potentially be receptive for the vulnerability. These are both well known and world wide suppliers within their domains. We immediately shut down these products and patched them according to the suppliers recommendations. This was not something noticed by our customers.
We have been monitoring all our systems for hostile activity, and we have no indication that any of our systems have been compromised. The tracking will continue in the time to come.
https://nsm.no/fagomrader/digital-sikkerhet/nasjonalt-cybersikkerhetssenter/varsler-fra-ncsc/utvidet-oppdatering-for-apache-log4j-cve-2021-44228
Simployer HRM and Simployer Expert Help does not use Java. We do however use 3rd party vendors that could potentially be impacted by the vulnerability.
We take the security of our customers very seriously, and upon learning about the Log4j flaw we closely evaluated our solutions and confirmed that they do not use Log4j. After evaluating all of our 3rd party vendors we discovered that two of the products we use internally could potentially be receptive for the vulnerability. These are both well known and world wide suppliers within their domains. We immediately shut down these products and patched them according to the suppliers recommendations. This was not something noticed by our customers.
We have been monitoring all our systems for hostile activity, and we have no indication that any of our systems have been compromised. The tracking will continue in the time to come.