CVE-2016-4462

HIGH

Apache OFBiz - Authenticated Remote Code Execution via ExternalLoginKey Freemarker Injection

Title source: llm

Description

By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are reflected on the webpage; a specially crafted Freemarker template could be used for remote code execution. Mitigation: Upgrade to Apache OFBiz 16.11.01

References (1)

Core 1

Core References

Third Party Advisory, URL Repurposed mailing-list x_refsource_mlist

http://git.net/ml/dev.ofbiz.apache.org/2016-11/msg00180.html

Scores

CVSS v3 8.8

EPSS 0.0053

EPSS Percentile 67.6%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-20

Status published

Products (21)

apache/ofbiz 11.04

apache/ofbiz 11.04.01

apache/ofbiz 11.04.02

apache/ofbiz 11.04.03

apache/ofbiz 11.04.04

apache/ofbiz 11.04.05

apache/ofbiz 11.04.06

apache/ofbiz 12.04

apache/ofbiz 12.04.01

apache/ofbiz 12.04.02

... and 11 more

Published Aug 30, 2017

Tracked Since Feb 18, 2026