CVE-2007-6433: Input Validation
Published Dec 18, 2007
·Updated
The getRenderedEjbql method in the org.jboss.seam.framework.Query class in JBoss Seam 2.x before 2.0.0.CR3 allows remote attackers to inject and execute arbitrary EJBQL commands via the order parameter.
Affected Software
1 affected component
JBoss seam<=2.0.0
Event History
Dec 18, 2007
CVE Published
08:46 PM
Dec 19, 2007
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2007-6433?
CVE-2007-6433 has a high severity rating due to the potential for remote code execution through EJBQL injection.
2
How do I fix CVE-2007-6433?
To fix CVE-2007-6433, upgrade to JBoss Seam version 2.0.0.CR3 or later.
3
What systems are affected by CVE-2007-6433?
CVE-2007-6433 affects JBoss Seam versions prior to 2.0.0.CR3, specifically 2.x versions up to and including 2.0.0.
4
What type of vulnerability is CVE-2007-6433?
CVE-2007-6433 is a code injection vulnerability that allows attackers to execute arbitrary EJBQL commands.
5
Can CVE-2007-6433 be exploited remotely?
Yes, CVE-2007-6433 can be exploited remotely, allowing attackers to inject malicious EJBQL commands.