« Volver al listado

CVE-2016-4462

Estado: ModificadaAlta (8.8)—

By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are reflected on the webpage; a specially crafted Freemarker template could be used for remote code execution. Mitigation: Upgrade to Apache OFBiz 16.11.01

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Apache — Ofbiz

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-4462",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache OFBiz",
          "versions": [
            {
              "status": "affected",
              "version": "13.07.*"
            },
            {
              "status": "affected",
              "version": "12.04.*"
            },
            {
              "status": "affected",
              "version": "11.04.*"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-08-30T17:29:00.200",
  "references": [
    {
      "url": "http://git.net/ml/dev.ofbiz.apache.org/2016-11/msg00180.html",
      "tags": [
        "Third Party Advisory",
        "URL Repurposed"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "http://git.net/ml/dev.ofbiz.apache.org/2016-11/msg00180.html",
      "tags": [
        "Third Party Advisory",
        "URL Repurposed"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are reflected on the webpage; a specially crafted Freemarker template could be used for remote code execution. Mitigation: Upgrade to Apache OFBiz 16.11.01"
    },
    {
      "lang": "es",
      "value": "Manipulando el parámetro de URL externalLoginKey, un usuario conectado malicioso podría pasar directivas Freemarker válidas que están reflejadas en la página web al motor de plantillas. Se podría utilizar utilizar una plantilla Freemarker especialmente manipulada para ejecutar código remotamente. Mitigación: Actualizar a Apache OFBiz 16.11.01."
    }
  ],
  "lastModified": "2026-06-17T00:47:36.167",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:11.04:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "08F6B330-C78D-4154-AF2C-BEB9DB93EE4D"
            },
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:11.04.01:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4BC9FE7F-EAAB-42DC-B0B0-81B484C06571"
            },
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:11.04.02:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "770795DB-628C-4C60-B89A-81054048A56C"
            },
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:11.04.03:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B9EA2BA6-F97C-4FBF-AC8C-1EEB4A68C74F"
            },
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:11.04.04:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E43C1CD5-4471-4D47-A722-7912E3E6A085"
            },
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:11.04.05:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5F62059B-B4F5-46A9-9F45-5164B1C55301"
            },
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:11.04.06:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1D2B0979-07EB-4EA6-986F-EF3B0D06B0F3"
            },
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:12.04:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3E6FE9CD-D075-427D-85FC-3C002428E7A6"
            },
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:12.04.01:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7A557337-D8FD-47F4-9E66-9A642B834E7D"
            },
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:12.04.02:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "50FFA2EC-0680-4ECA-BFCA-CE6EAF5611F3"
            },
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:12.04.03:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4BB02CEF-3431-4138-AC3D-27363073C29C"
            },
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:12.04.04:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BFDA615A-5A77-4F1B-881B-B3B675082CB7"
            },
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:12.04.05:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C0442A7B-10C0-4C74-9C61-BAEDA6404D73"
            },
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:12.04.06:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BADCBD31-3325-4881-AE84-BC661266E7F8"
            },
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:13.07:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EE4A20AD-9F08-4E96-9A78-357B62988F37"
            },
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:13.07.01:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A5435A8B-111C-4512-ABAB-9B89503C12E4"
            },
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:13.07.02:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F6E714B9-7B4D-4CC9-8280-1573D82E293A"
            },
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:13.07.03:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B341FB66-0E42-488D-92AC-A851ABAA8D0C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}