Skip to content
Fencer Vulns
high 7.5

CVE-2007-6433 json

The getRenderedEjbql method in the org.jboss.seam.framework.Query class in JBoss Seam 2.x before 2.0.0.CR3 allows remote attackers to injec…

published 2007-12-18 18 y ago modified 2026-06-16 4 mo ago also EUVD-2007-6399

cvss
7.5
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.2%
EPSS 3.2% chance of exploitation in 30 days, percentile 88%
public exploits
0
none known

Summary

The getRenderedEjbql method in the org.jboss.seam.framework.Query class in JBoss Seam 2.x before 2.0.0.CR3 allows remote attackers to inject and execute arbitrary EJBQL commands via the order parameter.

Patch / fix

  • jacorb jboss enterprise application platform 4.2.0 2.3.0-1jpp.ep1.5.el5
  • jbossas jboss enterprise application platform 4.2.0 4.2.0-4.GA_CP02.ep1.3.el5.3
  • jcommon jboss enterprise application platform 4.2.0 1.0.12-1jpp.ep1.2.el5
  • jbossweb jboss enterprise application platform 4.2.0 2.0.0-3.CP05.0jpp.ep1.1.el5
  • jboss-aop jboss enterprise application platform 4.2.0 1.5.5-1.CP01.0jpp.ep1.1.el5
  • hibernate3 jboss enterprise application platform 4.2.0 3.2.4-1.SP1_CP02.0jpp.ep1.1.el5.1
  • jboss-seam jboss enterprise application platform 4.2.0 1.2.1-1.ep1.3.el5
  • jfreechart jboss enterprise application platform 4.2.0 1.0.9-1jpp.ep1.2.el5.1

red hat advisories RHSA-2008:0213RHSA-2008:0158RHSA-2008:0151

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2007-6433 updated

EJBQL injection via 'order' parameter

  • Red Hat Application Stack v1 for Enterprise Linux AS (v.4) jacorb 2.3.0-1jpp.ep1.4, wsdl4j 1.6.2-1jpp.ep1.8, jboss-seam 1.2.1-1.ep1.3.el4, jboss-common 1.2.1-0jpp.ep1.2, jcommon 1.0.12-1jpp.ep1.2.el4, jgroups 2.4.1-1.SP4.0jpp.ep1.2, +21 more Red Hat Application Stack v1 for Enterprise Linux ES (v.4) jacorb 2.3.0-1jpp.ep1.4, wsdl4j 1.6.2-1jpp.ep1.8, jboss-seam 1.2.1-1.ep1.3.el4, jboss-common 1.2.1-0jpp.ep1.2, jcommon 1.0.12-1jpp.ep1.2.el4, jgroups 2.4.1-1.SP4.0jpp.ep1.2, +21 more
    fixed: vendor fix RHSA-2008:0158
  • Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 AS jacorb 2.3.0-1jpp.ep1.4, jacorb-demo 2.3.0-1jpp.ep1.4, jboss-seam 1.2.1-1.ep1.3.el4, jcommon 1.0.12-1jpp.ep1.2.el4, jacorb-manual 2.3.0-1jpp.ep1.4, jgroups 2.4.1-1.SP4.0jpp.ep1.2, +17 more Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 ES jacorb 2.3.0-1jpp.ep1.4, jacorb-demo 2.3.0-1jpp.ep1.4, jboss-seam 1.2.1-1.ep1.3.el4, jcommon 1.0.12-1jpp.ep1.2.el4, jacorb-manual 2.3.0-1jpp.ep1.4, jgroups 2.4.1-1.SP4.0jpp.ep1.2, +17 more
    fixed: vendor fix RHSA-2008:0151
  • Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 5 Server jacorb 2.3.0-1jpp.ep1.5.el5, jboss-seam 1.2.1-1.ep1.3.el5, jcommon 1.0.12-1jpp.ep1.2.el5, jfreechart 1.0.9-1jpp.ep1.2.el5.1, jbossas 4.2.0-4.GA_CP02.ep1.3.el5.3, jbossweb 2.0.0-3.CP05.0jpp.ep1.1.el5, +8 more
    fixed: vendor fix RHSA-2008:0213
  • Red Hat Application Stack v1 for Enterprise Linux AS (v.4) jbossws-jboss42 1.2.1-0jpp.ep1.2.el4 Red Hat Application Stack v1 for Enterprise Linux ES (v.4) jbossws-jboss42 1.2.1-0jpp.ep1.2.el4 Red Hat Application Stack v2 for Enterprise Linux (v.5) jacorb 2.3.0-1jpp.ep1.5.el5, jboss-seam 1.2.1-1.ep1.3.el5, jcommon 1.0.12-1jpp.ep1.2.el5, juddi 0.9-0.rc4.2jpp.ep1.3.el5.1, concurrent 1.3.4-8jpp.ep1.6.el5.1, jfreechart 1.0.9-1jpp.ep1.2.el5.1, +19 more Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 AS wsdl4j 1.6.2-1jpp.ep1.8, jboss-common 1.2.1-0jpp.ep1.2, concurrent 1.3.4-7jpp.ep1.6.el4, glassfish-jstl 1.2.0-0jpp.ep1.2, jbossxb 1.0.0-2.SP1.0jpp.ep1.2.el4, glassfish-jaf 1.1.0-0jpp.ep1.10.el4, +2 more Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 4 ES wsdl4j 1.6.2-1jpp.ep1.8, jboss-common 1.2.1-0jpp.ep1.2, concurrent 1.3.4-7jpp.ep1.6.el4, glassfish-jstl 1.2.0-0jpp.ep1.2, jbossxb 1.0.0-2.SP1.0jpp.ep1.2.el4, glassfish-jaf 1.1.0-0jpp.ep1.10.el4, +2 more Red Hat JBoss Enterprise Application Platform 4.2.0 for RHEL 5 Server juddi 0.9-0.rc4.2jpp.ep1.3.el5.1, concurrent 1.3.4-8jpp.ep1.6.el5.1, glassfish-jaf 1.1.0-0jpp.ep1.9.el5, jgroups 2.4.1-1.SP4.0jpp.ep1.2.el5, glassfish-jstl 1.2.0-0jpp.ep1.2.el5, jboss-common 1.2.1-0jpp.ep1.2.el5.1, +10 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.23% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • jira.jboss.com http://jira.jboss.com/jira/browse/JBSEAM-2084 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.