CVE-2016-4999

No fix known EPSS 4%

SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the (1) Data Set Authoring or (2) Displayer editor UI.

Published 2016-08-05 · CVE record · OSV

Products: redhat dashbuilder, redhat jboss_bpm_suite, redhat jboss_enterprise_brms_platform