Information Disclosure

log4j-core is vulnerable to information disclosure. The library stores passwords as immutable strings, allowing a malicious user with access to the heap to obtain another user's password...