CVE-2016-4462

By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are…

published August 30, 2017

CVSS
—
EPSS
4%
Percentile
89.9
In the wild
Unconfirmed
What it is

By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are reflected on the webpage; a specially crafted Freemarker template could be used for remote code execution. Mitigation: Upgrade to Apache OFBiz 16.11.01

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03802 · 89.9th percentile
Published
2017-08-30T17:00Z
EPSS history
Timeline
  • 30 AUG 17:00Z
    By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are…
    cvelistv5