high8.8
CVE-2016-4462
By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are reflecte…
Impact
By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are reflected on the webpage; a specially crafted Freemarker template could be used for remote code execution. Mitigation: Upgrade to Apache OFBiz 16.11.01
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Ofbiz | Versions 11.04, 11.04.01, 11.04.02, 11.04.03, 11.04.04, 11.04.05 |