PT-2007-4073 · Adempiere · Adempiere

Published 2007-05-18 · Updated 2017-07-29 · CVE-2007-2759

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Adempiere versions prior to 3.1.6

Description The issue concerns SQL injection vulnerabilities in the insert function of the ValuePreference class. These vulnerabilities allow remote attackers to execute arbitrary SQL commands by manipulating the m Attribute or m Value parameters.

Recommendations For versions prior to 3.1.6, update to version 3.1.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the insert function in the ValuePreference class to minimize the risk of exploitation. Avoid using the m Attribute and m Value parameters in the affected function until the issue is resolved.

Fix

Related Identifiers

CVE-2007-2759

Affected Products

Adempiere

References · 5

• http://adempiere.com/wiki/index.php/Release_316 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2007-2759 · Security Note
• http://vupen.com/english/advisories/2007/1842 · Note
• http://osvdb.org/37956 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34325 · Note