CVE-2016-4999 — SQL Injection in Redhat Dashbuilder

CWE-89 — SQL Injection5 documents5 sources
Severity
9.8CRITICALNVD
EPSS
7.0%
top 8.53%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Redhat DashbuilderRedhat Jboss BPM SuiteRedhat Jboss Enterprise Brms Platform
Timeline
PublishedAug 5
Latest updateMay 13

Description

SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the (1) Data Set Authoring or (2) Displayer editor UI.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶NVDredhat/jboss_bpm_suite5 versions+4

🔴Vulnerability Details

2
GHSA
GHSA-44p5-rm8g-w75h: SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect↗2022-05-13
▶
CVEList
CVE-2016-4999: SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect↗2016-08-05
▶

📋Vendor Advisories

1
Red Hat
Dashbuilder: SQL Injection on data set lookup filters↗2016-07-14
▶

💬Community

1
Bugzilla
CVE-2016-4999 Dashbuilder: SQL Injection on data set lookup filters↗2016-06-24
▶
CVE-2016-4999 — SQL Injection in Redhat Dashbuilder | cvebase