Apache OFBiz Freemarker Instruction Code Execution Vulnerability

Apache OFBiz is an enterprise resource planning system from the Apache Software Foundation in the United States. Apache OFBiz has a security vulnerability in passing valid Freemarker commands to the Template Engine, allowing remote attackers to exploit the vulnerability to construct special...

CVE-2016-4462

By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are reflected on the webpage; a specially crafted Freemarker template could be used for remote code execution. Mitigation: Upgrade to Apache OFBiz...