Bug 426206 (CVE-2007-6433) - CVE-2007-6433 EJBQL injection via 'order' parameter
Summary: CVE-2007-6433 EJBQL injection via 'order' parameter
Keywords:
Status: RELEASE_PENDING
Alias: CVE-2007-6433
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Fernando Nasser
QA Contact:
URL: http://www.securityfocus.com/bid/26850/
Whiteboard:
Depends On: 433820 433821
Blocks:
TreeView+ depends on / blocked
 
Reported: 2007-12-19 10:59 UTC by Marc Schoenefeld
Modified: 2022-12-01 00:24 UTC (History)
0 users

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2008:0151 0 normal SHIPPED_LIVE Moderate: JBoss Enterprise Application Platform 4.2.0CP02 security update 2008-04-02 20:44:45 UTC
Red Hat Product Errata RHSA-2008:0158 0 normal SHIPPED_LIVE Moderate: JBoss Enterprise Application Platform security update 2008-03-24 22:16:50 UTC
Red Hat Product Errata RHSA-2008:0213 0 normal SHIPPED_LIVE Moderate: JBoss Enterprise Application Platform 4.2.0CP02 security update 2008-04-02 20:42:53 UTC

Description Marc Schoenefeld 2007-12-19 10:59:00 UTC 
Additional info:he getRenderedEjbql method in the org.jboss.seam.framework.Query
class in JBoss Seam 2.x before 2.0.0.CR3 allows remote attackers to
inject and execute arbitrary EJBQL commands via the order parameter.

http://www.securityfocus.com/bid/26850/

http://sourceforge.net/project/shownotes.php?release_id=549490&group_id=22866
Note You need to log in before you can comment on or make changes to this bug.