CVE-2007-6433

Published: Dec 18, 2007Modified: Apr 23, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

The getRenderedEjbql method in the org.jboss.seam.framework.Query class in JBoss Seam 2.x before 2.0.0.CR3 allows remote attackers to inject and execute arbitrary EJBQL commands via the order parameter.

Affected (1)

Products: Jboss: Seam

Jboss

1 product

Seam

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Jboss Seam	Up to 2.0.0

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (18)

http://jira.jboss.com/jira/browse/JBSEAM-2084

Source: cve@mitre.org

Exploit

http://osvdb.org/42631

Source: cve@mitre.org

http://secunia.com/advisories/28077

Source: cve@mitre.org

Vendor Advisory

http://sourceforge.net/project/shownotes.php?release_id=549490&group_id=22866

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2008-0151.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2008-0158.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2008-0213.html

Source: cve@mitre.org

http://www.securityfocus.com/bid/26850

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2007/4215

Source: cve@mitre.org

http://jira.jboss.com/jira/browse/JBSEAM-2084