Critical
Security advisory
SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the (1) Data Set Authoring or (2) Displayer editor UI.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2016-4999
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:09 UTC · Revision 1
Source evidence
SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the (1) Data Set Authoring or (2) Displayer editor UI.
osv:CVE-2016-4999
Complete source record
{
"id": "e061330fc549ba45f818e62b34333a32cdd1598c8dcdf371d20f202a2bafd6b9",
"url": "https://osv.dev/vulnerability/CVE-2016-4999",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2016-4999",
"summary": "SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the (1) Data Set Authoring or (2) Displayer editor UI.",
"evidence": "osv:CVE-2016-4999",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2016-4999",
"aliases": [
"CVE-2016-4999"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/dashbuilder/dashbuilder",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "0eecbbbf717ec2eda81d5a408f94e3b4c023197f"
},
{
"fixed": "8574899e3b6455547b534f570b2330ff772e524b"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:redhat:dashbuilder:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "0.5.0"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "8574899e3b6455547b534f570b2330ff772e524b"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"0.5.0.Final"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-4999.json",
"vanir_signatures": [
{
"id": "CVE-2016-4999-5cda34e6",
"digest": {
"threshold": 0.9,
"line_hashes": [
"111647889128194931480811722479183416838",
"273985215608160427305160669618461684084",
"187139049491641220999445975182455683150",
"336640114799278420679753372525590489457"
]
},
"source": "https://github.com/dashbuilder/dashbuilder/commit/8574899e3b6455547b534f570b2330ff772e524b",
"target": {
"file": "dashbuilder-backend/dashbuilder-dataset-sql/src/test/java/org/dashbuilder/dataprovider/sql/SQLTestSuite.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2016-4999-c57147bc",
"digest": {
"threshold": 0.9,
"line_hashes": [
"105973552610407316146769326935849299456",
"114320129448123971438399054739505146646",
"148262174392690203089742235619161783127",
"219192059041892154837898543158867951865"
]
},
"source": "https://github.com/dashbuilder/dashbuilder/commit/8574899e3b6455547b534f570b2330ff772e524b",
"target": {
"file": "dashbuilder-backend/dashbuilder-dataset-sql/src/main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2016-4999-d9ee4bb4",
"digest": {
"length": 61,
"function_hash": "334569538173000158784445562462529603056"
},
"source": "https://github.com/dashbuilder/dashbuilder/commit/8574899e3b6455547b534f570b2330ff772e524b",
"target": {
"file": "dashbuilder-backend/dashbuilder-dataset-sql/src/main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java",
"function": "getStringParameterSQL"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-4999-dc6ad52d",
"digest": {
"length": 298,
"function_hash": "333188083673317335568536357355742992352"
},
"source": "https://github.com/dashbuilder/dashbuilder/commit/8574899e3b6455547b534f570b2330ff772e524b",
"target": {
"file": "dashbuilder-backend/dashbuilder-dataset-sql/src/test/java/org/dashbuilder/dataprovider/sql/SQLTestSuite.java",
"function": "setUp"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:14:18Z"
}
}
],
"modified": "2026-10-20T13:14:18.929052881Z",
"provider": "osv",
"references": [
"https://access.redhat.com/errata/RHSA-2016:1428",
"https://access.redhat.com/errata/RHSA-2016:1429",
"https://github.com/dashbuilder/dashbuilder/commit/8574899e3b6455547b534f570b2330ff772e524b",
"https://bugzilla.redhat.com/show_bug.cgi?id=1349990",
"https://issues.jboss.org/browse/DASHBUILDE-113"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:redhat:jboss_bpm_suite:6.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:redhat:jboss_bpm_suite:6.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:redhat:jboss_bpm_suite:6.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:redhat:jboss_bpm_suite:6.1.2:*:*:*:*:*:*:*",
"cpe:2.3:a:redhat:jboss_bpm_suite:6.1:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:jboss_bpm_suite",
"extracted_events": [
{
"range": [
{
"introduced": "6.0.0"
},
{
"last_affected": "6.0.0"
},
{
"introduced": "6.0.1"
},
{
"last_affected": "6.0.1"
},
{
"introduced": "6.0.3"
},
{
"last_affected": "6.0.3"
},
{
"introduced": "6.1"
},
{
"last_affected": "6.1"
},
{
"introduced": "6.1.2"
},
{
"last_affected": "6.1.2"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:redhat:jboss_enterprise_brms_platform:5.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:redhat:jboss_enterprise_brms_platform:5.3.1:*:*:*:*:*:*:*",
"cpe:2.3:a:redhat:jboss_enterprise_brms_platform:6.0.0:*:*:*:*:*:*:*",
"cpe:2.3:a:redhat:jboss_enterprise_brms_platform:6.0.1:*:*:*:*:*:*:*",
"cpe:2.3:a:redhat:jboss_enterprise_brms_platform:6.0.2:*:*:*:*:*:*:*",
"cpe:2.3:a:redhat:jboss_enterprise_brms_platform:6.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:redhat:jboss_enterprise_brms_platform:6.1:*:*:*:*:*:*:*",
"cpe:2.3:a:redhat:jboss_enterprise_brms_platform:6.3:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:jboss_enterprise_brms_platform",
"extracted_events": [
{
"range": [
{
"introduced": "5.0.0"
},
{
"last_affected": "5.0.0"
},
{
"introduced": "5.3.1"
},
{
"last_affected": "5.3.1"
},
{
"introduced": "6.0.0"
},
{
"last_affected": "6.0.0"
},
{
"introduced": "6.0.1"
},
{
"last_affected": "6.0.1"
},
{
"introduced": "6.0.2"
},
{
"last_affected": "6.0.2"
},
{
"introduced": "6.0.3"
},
{
"last_affected": "6.0.3"
},
{
"introduced": "6.1"
},
{
"last_affected": "6.1"
},
{
"introduced": "6.3"
},
{
"last_affected": "6.3"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2016-4999",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 387361,
"published_at": "2016-08-05T15:59:06.987+00:00"
}