CVE-2016-4999

State: Published
Severity: Not scored
Published: Aug 5, 2016
Updated: Aug 6, 2024
Reserved: May 24, 2016

Description

SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the (1) Data Set Authoring or (2) Displayer editor UI.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

RHSA-2016:1429vendor-advisory
https://issues.jboss.org/browse/DASHBUILDE-113
RHSA-2016:1428vendor-advisory
91795vdb-entry
https://github.com/dashbuilder/dashbuilder/commit/8574899e3b6455547b534f570b2330ff772e524b
https://bugzilla.redhat.com/show_bug.cgi?id=1349990

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.