Return to Question

EDIT (this is an important clue [see my answer]) : Please note that the search bar field triggers a search via SORLJ which requires a SOLR installation on disk. So a version of SOLR was installed on disk and did not change when I removed the older LOG4J version from my program internal libraries.

Yet I am quite surprised that after this log4j upgrade, when I input the payload provided by https://log4shell.huntress.com/ it still logs an input at their site. Can it be that a vulnerable version of log4j is still used somewhere in my project although it does not appear in the dependency tree ? Or does it come from another library (one from the above list) ?

Yet I am quite surprised that after this log4j upgrade, when I input the payload provided by https://log4shell.huntress.com/ it still logs an input at their site.

The payload is input in a search bar field on a web page. I also tried to input the payload on the login page of my web site but it did not trigger the writing of an entry at Huntress site.

Can it be that a vulnerable version of log4j is still used somewhere in my project although it does not appear in the dependency tree ? Or does it come from another library (one from the above list) ?

Any help appreciated,

Thank you

Any help appreciated.