PT-2017-8497 · Apache · Apache Ofbiz

Published 2017-08-30 · Updated 2024-02-14 · CVE-2016-4462

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 16.11.01

Description The issue allows a malicious, logged-in user to manipulate the externalLoginKey URL parameter to pass valid Freemarker directives to the Template Engine, which are then reflected on the webpage. This could be exploited using a specially crafted Freemarker template for remote code execution.

Recommendations For versions prior to 16.11.01, upgrade to Apache OFBiz 16.11.01 to resolve the issue. As a temporary workaround, consider restricting access to the externalLoginKey parameter in the affected URL to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2016-4462

Affected Products

Apache Ofbiz

References · 3

• https://osv.dev/vulnerability/CVE-2016-4462 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4462 · Security Note
• http://git.net/ml/dev.ofbiz.apache.org/2016-11/msg00180.html · Note