CVE-2015-2912 OrientDB-Server vulnerable to Cross-Site Request Forgery
HighCVSS 8.8
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The JSONP endpoint in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict callback values, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and obtain sensitive information, via a crafted HTTP request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| com.orientechnologies/orientdb-studio(Maven) | < 2.0.15 | 2.0.15 |
| com.orientechnologies/orientdb-studio(Maven) | = 2.1.0 | No fix listed |
| com.orientechnologies/orientdb-studio(Maven) | >= 2.1.0, < 2.1.1 | 2.1.1 |
| orientdb | <= 2.0.14 | No fix listed |
| orientdb | = 2.1.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com vendor-advisory
- github.com vendor-advisory
- VU#845332 third-party-advisory us-government-resource
- github.com product