PT-2017-8497 · Apache · Apache Ofbiz

CVE-2016-4462 · Publicado 2017-08-30 · Atualizado 2024-02-14

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 16.11.01

Description The issue allows a malicious, logged-in user to manipulate the externalLoginKey URL parameter to pass valid Freemarker directives to the Template Engine, which are then reflected on the webpage. This could be exploited using a specially crafted Freemarker template for remote code execution.

Recommendations For versions prior to 16.11.01, upgrade to Apache OFBiz 16.11.01 to resolve the issue. As a temporary workaround, consider restricting access to the externalLoginKey parameter in the affected URL to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2016-4462

Produtos afetados

Apache Ofbiz

Referências · 3

• http://git.net/ml/dev.ofbiz.apache.org/2016-11/msg00180.html · Nota
• https://osv.dev/vulnerability/CVE-2016-4462 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-4462 · Nota de Segurança