Orientdb · Orientdb 3.0.17 Ga Community Edition · CVE-2019-25447
**Name of the Vulnerable Software and Affected Versions**
OrientDB version 3.0.17 GA Community Edition
**Description**
The software contains cross-site request forgery flaws that could allow attackers to perform unauthorized actions. This is achieved by creating malicious requests to API endpoints such as '/database/', '/command/', and '/document/'. Specifically, attackers can create or delete databases, modify schema classes, manage users, and create functions by sending authenticated requests without proper token validation. These issues are combined with reflected and stored cross-site scripting flaws in the web interface.
**Recommendations**
Apply updates to address the identified cross-site request forgery and cross-site scripting issues.