CVE-2016-4462
HighSummary
CVE-2016-4462 allows a malicious, logged-in user to manipulate the URL parameter externalLoginKey, potentially leading to remote code execution via a specially crafted Freemarker template.
Risk Assessment
The risk to the organization involves the potential for remote code execution, which could lead to system compromise or data leakage.
Recommendation
It is recommended to upgrade to Apache OFBiz version 16.11.01 to mitigate this vulnerability.
Other vulnerabilities in Apache OFBiz
See all- CVE-2026-46586High
Apache OFBiz has a vulnerability related to improper control of code generation and improper neutralization of directives in dynamically evaluated code. This issue affects versions before 24.09.06.
- CVE-2026-31910High
The Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz before version 24.09.06 allows an attacker to use the server to send requests to internal or external resources.
- CVE-2026-31909High
The CVE-2026-31909 vulnerability in Apache OFBiz involves exposure of sensitive information to unauthorized actors. This issue affects versions before 24.09.06.
- CVE-2026-29226High
The SSRF vulnerability in Apache OFBiz, occurring in Content component operations, allows an attacker to send malicious requests to the server. This issue affects versions of Apache OFBiz before 24.09.06.
- CVE-2026-45434Critical
CVE-2026-45434 in Apache OFBiz has a flaw in password-change logic that can lead to remote code execution. This issue affects versions before 24.09.06.
- CVE-2026-41919Critical
CVE-2026-41919 describes an improper neutralization of special elements used in LDAP queries, leading to LDAP Injection vulnerability in Apache OFBiz.
- CVE-2026-31986Critical
Use of hard-coded cryptographic key vulnerability in Apache OFBiz. This issue affects versions before 24.09.06.
- CVE-2012-1622Critical
Apache OFBiz 10.04.x before 10.04.02 allows remote attackers to execute arbitrary code via unspecified vectors.
- CVE-2016-2170Critical
Apache OFBiz versions 12.04.x before 12.04.06 and 13.07.x before 13.07.03 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
- CVE-2026-50223High
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz allows a low-privileged authenticated user with Content/DataResource editing privileges to perform template injection attacks that could lead to Remote Code Execution. This issue affects Apache OFBiz before 24.09.07.
Original NVD description (English source)
By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are reflected on the webpage; a specially crafted Freemarker template could be used for remote code execution. Mitigation: Upgrade to Apache OFBiz 16.11.01