Unscored severity · published Dec 18, 2007
CVE-2007-6433
The getRenderedEjbql method in the org.jboss.seam.framework.Query class in JBoss Seam 2.x before 2.0.0.CR3 allows remote attackers to inject and execute arbitrary EJBQL commands…
–
CVSS
3.2%
EPSS
No
On KEV
Description
The getRenderedEjbql method in the org.jboss.seam.framework.Query class in JBoss Seam 2.x before 2.0.0.CR3 allows remote attackers to inject and execute arbitrary EJBQL commands via the order parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.2% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
Seam · Jboss
through 2.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-6433
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-6433
Exploit
http://jira.jboss.com/jira/browse/JBSEAM-2084
osvdb.org
http://osvdb.org/42631
Vendor Advisory
http://secunia.com/advisories/28077
sourceforge.net
http://sourceforge.net/project/shownotes.php?release_id=549490&group_id=22866
www.redhat.com
http://www.redhat.com/support/errata/RHSA-2008-0151.html
www.redhat.com
http://www.redhat.com/support/errata/RHSA-2008-0158.html