CVE-2017-11467 OrientDB vulnerable to Improper Privilage Management leading to arbitrary command injection
CriticalCVSS 9.8
EPSS 73.1%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote attackers to execute arbitrary OS commands via a crafted request.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| com.orientechnologies/orientdb-core(Maven) | < 2.2.23 | 2.2.23 |
| com.orientechnologies/orientdb-core(Maven) | = 1.0 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 1.0.1 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 1.0rc9 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 1.1.0 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 1.2.0 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 1.3.0 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 1.4.0 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 1.4.1 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 1.5.0 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 1.5.1 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 1.6 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 1.6.1 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 1.6.2 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 1.6.3 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 1.6.4 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 1.6.5 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 1.6.6 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 1.7 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 1.7-rc1 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 1.7-rc2 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 1.7.1 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 1.7.10 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 1.7.2 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 1.7.3 | No fix listed |
Show 89 more
| Product | Affected versions | Fixed in |
|---|---|---|
| com.orientechnologies/orientdb-core(Maven) | = 1.7.4 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 1.7.5 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 1.7.6 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 1.7.7 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 1.7.8 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 1.7.9 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.0 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.0-M1 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.0-M2 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.0-M3 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.0-rc1 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.0-rc2 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.0.1 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.0.10 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.0.11 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.0.12 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.0.13 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.0.14 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.0.15 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.0.16 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.0.17 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.0.18 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.0.2 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.0.3 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.0.4 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.0.5 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.0.6 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.0.7 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.0.8 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.0.9 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.1-rc1 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.1-rc2 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.1-rc3 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.1-rc4 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.1-rc5 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.1-rc6 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.1.0 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.1.1 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.1.10 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.1.11 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.1.12 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.1.13 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.1.14 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.1.15 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.1.16 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.1.17 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.1.18 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.1.19 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.1.2 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.1.20 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.1.21 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.1.22 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.1.23 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.1.24 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.1.25 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.1.3 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.1.4 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.1.5 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.1.6 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.1.7 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.1.8 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.1.9 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.2.0 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.2.0-beta | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.2.0-beta2 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.2.0-rc1 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.2.1 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.2.10 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.2.11 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.2.12 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.2.13 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.2.14 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.2.15 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.2.16 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.2.17 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.2.18 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.2.19 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.2.2 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.2.20 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.2.21 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.2.22 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.2.3 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.2.4 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.2.5 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.2.6 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.2.7 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.2.8 | No fix listed |
| com.orientechnologies/orientdb-core(Maven) | = 2.2.9 | No fix listed |
| orientdb | <= 2.2.22 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com vendor-advisory
- github.com product
- github.com third-party-advisory
- web.archive.org
- www.heavensec.org exploit third-party-advisory url-repurposed