PT-2007-4073 · Adempiere · Adempiere

Publicado 2007-05-18 · Atualizado 2017-07-29 · CVE-2007-2759

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Adempiere versions prior to 3.1.6

Description The issue concerns SQL injection vulnerabilities in the insert function of the ValuePreference class. These vulnerabilities allow remote attackers to execute arbitrary SQL commands by manipulating the m Attribute or m Value parameters.

Recommendations For versions prior to 3.1.6, update to version 3.1.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the insert function in the ValuePreference class to minimize the risk of exploitation. Avoid using the m Attribute and m Value parameters in the affected function until the issue is resolved.

Correção

Identificadores relacionados

CVE-2007-2759

Produtos afetados

Adempiere

Referências · 5

• http://vupen.com/english/advisories/2007/1842 · Nota
• http://adempiere.com/wiki/index.php/Release_316 · Correção
• http://osvdb.org/37956 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-2759 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34325 · Nota