CVE-2016-4999

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2016-4999
SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the (1) Data Set Authoring or (2) Displayer editor UI.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://www.securityfocus.com/bid/91795 Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2016:1428 Vendor Advisory
https://access.redhat.com/errata/RHSA-2016:1429 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1349990 Issue Tracking
https://github.com/dashbuilder/dashbuilder/commit/8574899e3b6455547b534f570b2330ff772e524b Third Party Advisory
https://issues.jboss.org/browse/DASHBUILDE-113 Permissions Required
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:redhat:dashbuilder:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_bpm_suite:6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_bpm_suite:6.0.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_bpm_suite:6.0.3:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_bpm_suite:6.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_bpm_suite:6.1.2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_brms_platform:5.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_brms_platform:5.3.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_brms_platform:6.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_brms_platform:6.0.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_brms_platform:6.0.2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_brms_platform:6.0.3:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_brms_platform:6.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:jboss_enterprise_brms_platform:6.3:*:*:*:*:*:*:*
History

27 Apr 2021, 13:55

Type Values Removed Values Added
CPE cpe:2.3:a:dashbuilder_project:dashbuilder:-:*:*:*:*:*:*:* cpe:2.3:a:redhat:dashbuilder:*:*:*:*:*:*:*:*
References (CONFIRM) https://github.com/dashbuilder/dashbuilder/commit/8574899e3b6455547b534f570b2330ff772e524b - (CONFIRM) https://github.com/dashbuilder/dashbuilder/commit/8574899e3b6455547b534f570b2330ff772e524b - Third Party Advisory
Information

Published : 2016-08-05 15:59

Updated : 2023-12-10 11:46

NVD link : CVE-2016-4999

Mitre link : CVE-2016-4999

CVE.ORG link : CVE-2016-4999

JSON object : View

Products Affected

redhat

  • jboss_enterprise_brms_platform
  • dashbuilder
  • jboss_bpm_suite
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')