CVE-2015-2913 OrientDB Server Community Edition uses insufficiently random values to generate session IDs
MediumCVSS 5.9
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
server/network/protocol/http/OHttpSessionManager.java in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 improperly relies on the java.util.Random class for generation of random Session ID values, which makes it easier for remote attackers to predict a value by determining the internal state of the PRNG in this class.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| com.orientechnologies/orientdb-server(Maven) | < 2.0.15 | 2.0.15 |
| com.orientechnologies/orientdb-server(Maven) | = 2.1.0 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 1.0 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 1.0.1 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 1.0rc9 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 1.1.0 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 1.2.0 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 1.3.0 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 1.4.0 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 1.4.1 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 1.5.0 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 1.5.1 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 1.6 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 1.6.1 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 1.6.2 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 1.6.3 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 1.6.4 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 1.6.5 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 1.6.6 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 1.7 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 1.7-rc1 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 1.7-rc2 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 1.7.1 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 1.7.10 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 1.7.2 | No fix listed |
Show 30 more
| Product | Affected versions | Fixed in |
|---|---|---|
| com.orientechnologies/orientdb-server(Maven) | = 1.7.3 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 1.7.4 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 1.7.5 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 1.7.6 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 1.7.7 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 1.7.8 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 1.7.9 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 2.0 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 2.0-M1 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 2.0-M2 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 2.0-M3 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 2.0-rc1 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 2.0-rc2 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 2.0.1 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 2.0.10 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 2.0.11 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 2.0.12 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 2.0.13 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 2.0.14 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 2.0.2 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 2.0.3 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 2.0.4 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 2.0.5 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 2.0.6 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 2.0.7 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 2.0.8 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | = 2.0.9 | No fix listed |
| com.orientechnologies/orientdb-server(Maven) | >= 2.1.0, < 2.1.1 | 2.1.1 |
| orientdb | = 2.0.14 | No fix listed |
| orientdb | = 2.1.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch vendor-advisory
- github.com vendor-advisory
- VU#845332 third-party-advisory us-government-resource
- github.com product