Seam logging evaluates expression language (EL) statements in log messages. If an application includes user-provided strings in log messages directly via string concatenation, then a remote attacker could inject EL statements directly into the log messages, which would be evaluated on the server. If debug logging is enabled, Zanata performs logging of user-supplied strings using string concatenation. A remote attacker could use this flaw to execute arbitrary code in the context of the application server running Zanata.
Upstream advisory: https://github.com/zanata/zanata-server/wiki/Security-advisories Upstream patch commit: https://github.com/zanata/zanata-server/commit/c4152ef90609367c870618aee8d49c302619cc40
Statement: Not Vulnerable. Zanata is not shipped in any supported Red Hat products.