CVE-2016-4999

Опубликовано: 05 авг. 2016

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the (1) Data Set Authoring or (2) Displayer editor UI.

Ссылки

http://www.securityfocus.com/bid/91795
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2016:1428
Vendor Advisory
https://access.redhat.com/errata/RHSA-2016:1429
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1349990
Issue Tracking
https://github.com/dashbuilder/dashbuilder/commit/8574899e3b6455547b534f570b2330ff772e524b
Third Party Advisory
https://issues.jboss.org/browse/DASHBUILDE-113
Permissions Required
http://www.securityfocus.com/bid/91795
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2016:1428
Vendor Advisory
https://access.redhat.com/errata/RHSA-2016:1429
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1349990
Issue Tracking
https://github.com/dashbuilder/dashbuilder/commit/8574899e3b6455547b534f570b2330ff772e524b
Third Party Advisory
https://issues.jboss.org/browse/DASHBUILDE-113
Permissions Required

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:redhat:dashbuilder:*:*:*:*:*:*:*:*

Версия до 0.5.0 (включая)

cpe:2.3:a:redhat:jboss_bpm_suite:6.0.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_bpm_suite:6.0.1:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_bpm_suite:6.0.3:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_bpm_suite:6.1:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_bpm_suite:6.1.2:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_brms_platform:5.0.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_brms_platform:5.3.1:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_brms_platform:6.0.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_brms_platform:6.0.1:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_brms_platform:6.0.2:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_brms_platform:6.0.3:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_brms_platform:6.1:*:*:*:*:*:*:*

cpe:2.3:a:redhat:jboss_enterprise_brms_platform:6.3:*:*:*:*:*:*:*

EPSS

Процентиль: 91%

0.06972

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-89

Связанные уязвимости

CVE-2016-4999

CVSS3: 8.8

redhat

больше 9 лет назад

GHSA-44p5-rm8g-w75h