CVE-2016-4462 | BDVDB-2026-89765 Detail

ApacheApache OFBiz

Description#

By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are reflected on the webpage; a specially crafted Freemarker template could be used for remote code execution. Mitigation: Upgrade to Apache OFBiz 16.11.01

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

http://git.net/ml/dev.ofbiz.apache.org/2016-11/msg00180.html

Exploit#

No public exploit known

History#

Version 12017-08-30Record published in the CVE List.
Version 22024-09-17Most recent update recorded in the CVE List.