CVE-2016-4462

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-08-30 · updated 2026-06-17
Weakness: CWE-20

Description

By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are reflected on the webpage; a specially crafted Freemarker template could be used for remote code execution. Mitigation: Upgrade to Apache OFBiz 16.11.01

Affected products

Apache Software Foundation Apache OFBiz: 11.04, 11.04.01, 11.04.02, 11.04.03, 11.04.04, 11.04.05 (+12)

References

http://git.net/ml/dev.ofbiz.apache.org/2016-11/msg00180.html
http://git.net/ml/dev.ofbiz.apache.org/2016-11/msg00180.html

Get alerted when CVE-2016-4462 or the next vulnerability affects your stack