PT-2017-8497 · Apache · Apache Ofbiz

Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions prior to 16.11.01 Description: The issue allows a malicious, logged-in user to manipulate the externalLoginKey URL parameter to pass valid Freemarker directives to the Template Engine, which are then reflected on the...