PT-2016-6213 · Red Hat · Dashbuilder

Pavel Polischouk · Published 2016-08-05 · Updated 2021-04-27 · CVE-2016-4999

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dashbuilder versions prior to 0.6.0.Beta1

Description The issue allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the Data Set Authoring or Displayer editor UI. This is due to a SQL injection vulnerability in the getStringParameterSQL method.

Recommendations For versions prior to 0.6.0.Beta1, update to version 0.6.0.Beta1 or later to resolve the issue. As a temporary workaround, consider restricting access to the getStringParameterSQL method in the DefaultDialect.java file until a patch is available. Avoid using the data set lookup filter in the Data Set Authoring or Displayer editor UI until the issue is resolved.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2016-4999

Affected Products

Dashbuilder

References · 9

• https://access.redhat.com/errata/RHSA-2016:1429 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4999 · Security Note
• https://access.redhat.com/errata/RHSA-2016:1428 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-4999 · Vendor Advisory
• https://github.com/dashbuilder/dashbuilder/commit/8574899e3b6455547b534f570b2330ff772e524b · Note
• https://t.me/cvenotify/13803 · Telegram Post
• https://issues.jboss.org/browse/DASHBUILDE-113 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1349990 · Note
• http://securityfocus.com/bid/91795 · Note