{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-02T10:21:55.823","vulnerabilities":[{"cve":{"id":"CVE-2016-4462","sourceIdentifier":"security@apache.org","published":"2017-08-30T17:29:00.200","lastModified":"2026-05-13T00:24:29.033","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template Engine that are reflected on the webpage; a specially crafted Freemarker template could be used for remote code execution. Mitigation: Upgrade to Apache OFBiz 16.11.01"},{"lang":"es","value":"Manipulando el parámetro de URL externalLoginKey, un usuario conectado malicioso podría pasar directivas Freemarker válidas que están reflejadas en la página web al motor de plantillas. Se podría utilizar utilizar una plantilla Freemarker especialmente manipulada para ejecutar código remotamente. Mitigación: Actualizar a Apache OFBiz 16.11.01."}],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.0,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-20"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:ofbiz:11.04:*:*:*:*:*:*:*","matchCriteriaId":"08F6B330-C78D-4154-AF2C-BEB9DB93EE4D"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:ofbiz:11.04.01:*:*:*:*:*:*:*","matchCriteriaId":"4BC9FE7F-EAAB-42DC-B0B0-81B484C06571"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:ofbiz:11.04.02:*:*:*:*:*:*:*","matchCriteriaId":"770795DB-628C-4C60-B89A-81054048A56C"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:ofbiz:11.04.03:*:*:*:*:*:*:*","matchCriteriaId":"B9EA2BA6-F97C-4FBF-AC8C-1EEB4A68C74F"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:ofbiz:11.04.04:*:*:*:*:*:*:*","matchCriteriaId":"E43C1CD5-4471-4D47-A722-7912E3E6A085"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:ofbiz:11.04.05:*:*:*:*:*:*:*","matchCriteriaId":"5F62059B-B4F5-46A9-9F45-5164B1C55301"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:ofbiz:11.04.06:*:*:*:*:*:*:*","matchCriteriaId":"1D2B0979-07EB-4EA6-986F-EF3B0D06B0F3"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:ofbiz:12.04:*:*:*:*:*:*:*","matchCriteriaId":"3E6FE9CD-D075-427D-85FC-3C002428E7A6"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:ofbiz:12.04.01:*:*:*:*:*:*:*","matchCriteriaId":"7A557337-D8FD-47F4-9E66-9A642B834E7D"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:ofbiz:12.04.02:*:*:*:*:*:*:*","matchCriteriaId":"50FFA2EC-0680-4ECA-BFCA-CE6EAF5611F3"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:ofbiz:12.04.03:*:*:*:*:*:*:*","matchCriteriaId":"4BB02CEF-3431-4138-AC3D-27363073C29C"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:ofbiz:12.04.04:*:*:*:*:*:*:*","matchCriteriaId":"BFDA615A-5A77-4F1B-881B-B3B675082CB7"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:ofbiz:12.04.05:*:*:*:*:*:*:*","matchCriteriaId":"C0442A7B-10C0-4C74-9C61-BAEDA6404D73"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:ofbiz:12.04.06:*:*:*:*:*:*:*","matchCriteriaId":"BADCBD31-3325-4881-AE84-BC661266E7F8"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:ofbiz:13.07:*:*:*:*:*:*:*","matchCriteriaId":"EE4A20AD-9F08-4E96-9A78-357B62988F37"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:ofbiz:13.07.01:*:*:*:*:*:*:*","matchCriteriaId":"A5435A8B-111C-4512-ABAB-9B89503C12E4"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:ofbiz:13.07.02:*:*:*:*:*:*:*","matchCriteriaId":"F6E714B9-7B4D-4CC9-8280-1573D82E293A"},{"vulnerable":true,"criteria":"cpe:2.3:a:apache:ofbiz:13.07.03:*:*:*:*:*:*:*","matchCriteriaId":"B341FB66-0E42-488D-92AC-A851ABAA8D0C"}]}]}],"references":[{"url":"http://git.net/ml/dev.ofbiz.apache.org/2016-11/msg00180.html","source":"security@apache.org","tags":["Third Party Advisory","URL Repurposed"]},{"url":"http://git.net/ml/dev.ofbiz.apache.org/2016-11/msg00180.html","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","URL Repurposed"]}]}}]}