CVE-2007-6433

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-12-18 · updated 2026-06-16
Weakness: CWE-20

Description

The getRenderedEjbql method in the org.jboss.seam.framework.Query class in JBoss Seam 2.x before 2.0.0.CR3 allows remote attackers to inject and execute arbitrary EJBQL commands via the order parameter.

Affected products

JBoss Seam: through 2.0.0

References

http://jira.jboss.com/jira/browse/JBSEAM-2084
http://osvdb.org/42631
http://secunia.com/advisories/28077
http://sourceforge.net/project/shownotes.php?release_id=549490&group_id=22866
http://www.redhat.com/support/errata/RHSA-2008-0151.html
http://www.redhat.com/support/errata/RHSA-2008-0158.html
http://www.redhat.com/support/errata/RHSA-2008-0213.html
http://www.securityfocus.com/bid/26850
http://www.vupen.com/english/advisories/2007/4215
http://jira.jboss.com/jira/browse/JBSEAM-2084
http://osvdb.org/42631
http://secunia.com/advisories/28077

Get alerted when CVE-2007-6433 or the next vulnerability affects your stack