CVE-2007-6433 The getRenderedEjbql method in the org.jboss.seam.framework.Query class in JBoss Seam 2.x before 2.0.0.CR3 allows remote attackers to inject and execute arbitrary EJBQL commands via the order paramete...
HighCVSS 7.5
EPSS 3.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The getRenderedEjbql method in the org.jboss.seam.framework.Query class in JBoss Seam 2.x before 2.0.0.CR3 allows remote attackers to inject and execute arbitrary EJBQL commands via the order parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jboss seam | <= 2.0.0 | No fix listed |
References
- jira.jboss.com exploit
- 42631 vdb-entry
- 28077 third-party-advisory vendor-advisory
- sourceforge.net
- RHSA-2008:0151 vendor-advisory
- RHSA-2008:0158 vendor-advisory
- RHSA-2008:0213 vendor-advisory
- 26850 vdb-entry
- ADV-2007-4215 vdb-entry