CVE-2016-4462

Published: Aug 30, 2017Modified: May 13, 2026

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are reflected on the webpage; a specially crafted Freemarker template could be used for remote code execution. Mitigation: Upgrade to Apache OFBiz 16.11.01

Affected (18)

Products: Apache: Ofbiz

Apache

1 product

Ofbiz

Configuration A

18 vulnerable

Vulnerable Software	Affected Versions
Apache Ofbiz	Version 11.04.01
Apache Ofbiz	Version 11.04.02
Apache Ofbiz	Version 11.04.03
Apache Ofbiz	Version 11.04.04
Apache Ofbiz	Version 11.04.05
Apache Ofbiz	Version 11.04.06
Apache Ofbiz	Version 11.04
Apache Ofbiz	Version 12.04.01
Apache Ofbiz	Version 12.04.02
Apache Ofbiz	Version 12.04.03
Apache Ofbiz	Version 12.04.04
Apache Ofbiz	Version 12.04.05
Apache Ofbiz	Version 12.04.06
Apache Ofbiz	Version 12.04
Apache Ofbiz	Version 13.07.01
Apache Ofbiz	Version 13.07.02
Apache Ofbiz	Version 13.07.03
Apache Ofbiz	Version 13.07

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (2)

http://git.net/ml/dev.ofbiz.apache.org/2016-11/msg00180.html

Source: security@apache.org

Third Party AdvisoryURL Repurposed

http://git.net/ml/dev.ofbiz.apache.org/2016-11/msg00180.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryURL Repurposed

Timeline

No history available yet.