Tech question - Log4j Vulnerability CVE-2021-44228

[alexanderputt]

Hi Team Concur,

Have there been any definitive statements from your organization around the Log4j vulnerability? As Concur / SAP may be already be aware, there is a critical vulnerability on the log4j library. How do we get a formal assessment from your technical teams to address the following:

• Is our version of Concur affected?
• If yes, do we have remediation planned and a target date to apply it?

CVE References

https://logging.apache.org/log4j/2.x/security.html.

https://www.cisa.gov/uscert/ncas/current-activity/2021/12/13/cisa-creates-webpage-apache-log4j-vulne...

[KevinD]

@alexanderputt I can't really speak to this topic other than saying that SAP has not sent out any communication about this issue to its employees. 

[NTS · Accepted solution]

Hi @alexanderputt 

check this document please: Concur Apache Log4j 

Hope it helps

[alexanderputt]

Thanks for this NTS, unfortunately the link you supplied doesn't work for me. But from your image I can see that appropriate patching and actions have been taken thanks. Is there a more appropriate forum to raise these types of questions?

[NTS]

@alexanderputt  have you checked Concur Support Portal or SAP Support Portal?

Both portals have info about the issue and the steps performed by SAP updated on a daily basis.

Regards

[fasteddiecamaro]

NEED to change information on Concur. Need to Change the

Group, Company, and Cost Center.

[KevinD]

@fasteddiecamaro could you provide a screenshot of where you need to change this information, please? There are a few places this information could be changed, so instead of listing the steps for all the different places, let's hone in on exactly where you need this changed. Thank you.

[dnguyenthc]

Can you please provide a link to those pages?

[sapwill2021]

Hi There I am unable to access this link ? https://concur.secure.force.com/CteSupport/servlet/fileField?retURL=%2FCteSupport%2Farticles%2Fen_US...