CVE-2016-4999: SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows…

Description

SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the (1) Data Set Authoring or (2) Displayer editor UI.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)3.7% · higher than 90% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

DA

Dashbuilder · Redhat

through 0.5.0 · source: NVD

JB

Jboss Bpm Suite · Redhat

6.0.0; 6.0.1; 6.0.3; 6.1; 6.1.2 · source: NVD

JE

Jboss Enterprise Brms Platform · Redhat

5.0.0; 5.3.1; 6.0.0; 6.0.1; 6.0.2; 6.0.3; +2 more · source: NVD