« Back to list

CVE-2016-4462

Status: ModifiedHigh (8.8)—

By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are reflected on the webpage; a specially crafted Freemarker template could be used for remote code execution. Mitigation: Upgrade to Apache OFBiz 16.11.01

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Apache — Ofbiz

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2016-4462",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@apache.org",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache OFBiz",
          "versions": [
            {
              "status": "affected",
              "version": "13.07.*"
            },
            {
              "status": "affected",
              "version": "12.04.*"
            },
            {
              "status": "affected",
              "version": "11.04.*"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-08-30T17:29:00.200",
  "references": [
    {
      "url": "http://git.net/ml/dev.ofbiz.apache.org/2016-11/msg00180.html",
      "tags": [
        "Third Party Advisory",
        "URL Repurposed"
      ],
      "source": "security@apache.org"
    },
    {
      "url": "http://git.net/ml/dev.ofbiz.apache.org/2016-11/msg00180.html",
      "tags": [
        "Third Party Advisory",
        "URL Repurposed"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are reflected on the webpage; a specially crafted Freemarker template could be used for remote code execution. Mitigation: Upgrade to Apache OFBiz 16.11.01"
    },
    {
      "lang": "es",
      "value": "Manipulando el parámetro de URL externalLoginKey, un usuario conectado malicioso podría pasar directivas Freemarker válidas que están reflejadas en la página web al motor de plantillas. Se podría utilizar utilizar una plantilla Freemarker especialmente manipulada para ejecutar código remotamente. Mitigación: Actualizar a Apache OFBiz 16.11.01."
    }
  ],
  "lastModified": "2026-06-17T00:47:36.167",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:11.04:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "08F6B330-C78D-4154-AF2C-BEB9DB93EE4D"
            },
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:11.04.01:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4BC9FE7F-EAAB-42DC-B0B0-81B484C06571"
            },
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:11.04.02:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "770795DB-628C-4C60-B89A-81054048A56C"
            },
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:11.04.03:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B9EA2BA6-F97C-4FBF-AC8C-1EEB4A68C74F"
            },
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:11.04.04:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E43C1CD5-4471-4D47-A722-7912E3E6A085"
            },
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:11.04.05:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5F62059B-B4F5-46A9-9F45-5164B1C55301"
            },
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:11.04.06:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1D2B0979-07EB-4EA6-986F-EF3B0D06B0F3"
            },
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:12.04:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3E6FE9CD-D075-427D-85FC-3C002428E7A6"
            },
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:12.04.01:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7A557337-D8FD-47F4-9E66-9A642B834E7D"
            },
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:12.04.02:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "50FFA2EC-0680-4ECA-BFCA-CE6EAF5611F3"
            },
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:12.04.03:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4BB02CEF-3431-4138-AC3D-27363073C29C"
            },
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:12.04.04:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BFDA615A-5A77-4F1B-881B-B3B675082CB7"
            },
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:12.04.05:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C0442A7B-10C0-4C74-9C61-BAEDA6404D73"
            },
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:12.04.06:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BADCBD31-3325-4881-AE84-BC661266E7F8"
            },
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:13.07:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EE4A20AD-9F08-4E96-9A78-357B62988F37"
            },
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:13.07.01:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A5435A8B-111C-4512-ABAB-9B89503C12E4"
            },
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:13.07.02:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F6E714B9-7B4D-4CC9-8280-1573D82E293A"
            },
            {
              "criteria": "cpe:2.3:a:apache:ofbiz:13.07.03:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B341FB66-0E42-488D-92AC-A851ABAA8D0C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@apache.org"
}