mirror of
https://github.com/0xMarcio/cve.git
synced 2026-03-26 04:00:31 +01:00
971 B
971 B
CVE-2016-4462
Description
By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are reflected on the webpage; a specially crafted Freemarker template could be used for remote code execution. Mitigation: Upgrade to Apache OFBiz 16.11.01
POC
Reference
No PoCs from references.