VulnerabilityModified

CVE-2016-4999

SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows remote attackers to execute arbitrary SQL commands via a data set lookup…

CRITICAL 9.8EPSS 3.65%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (3.65%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 3.65% probability · 89th percentile
CISA KEV: Not listed
Weakness: CWE-89
Affected: redhat/dashbuilder · redhat/jboss bpm suite · redhat/jboss enterprise brms platform
Source: secalert@redhat.com

References

http://www.securityfocus.com/bid/91795Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2016:1428Vendor Advisory
https://access.redhat.com/errata/RHSA-2016:1429Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1349990Issue Tracking
https://github.com/dashbuilder/dashbuilder/commit/8574899e3b6455547b534f570b2330ff772e524bThird Party Advisory
https://issues.jboss.org/browse/DASHBUILDE-113Permissions Required
http://www.securityfocus.com/bid/91795Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2016:1428Vendor Advisory
https://access.redhat.com/errata/RHSA-2016:1429Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1349990Issue Tracking
https://github.com/dashbuilder/dashbuilder/commit/8574899e3b6455547b534f570b2330ff772e524bThird Party Advisory
https://issues.jboss.org/browse/DASHBUILDE-113Permissions Required

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.