| Package | Affected versions | Patched versions |
|---|---|---|
| dashbuilder | ≤ 0.5.0 | |
| jboss bpm suite | = 6.0.0= 6.0.1= 6.0.3= 6.1= 6.1.2 | |
| jboss enterprise brms platform | = 5.0.0= 5.3.1= 6.0.0= 6.0.1= 6.0.2= 6.0.3= 6.1= 6.3 |
SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the (1) Data Set Authoring or (2) Displayer editor UI.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free