PT-2015-5970 · Orientdb · Orientdb Server Community Edition

Raffaela Frank · Publicado 2015-12-31 · Atualizado 2018-10-18 · CVE-2015-2912

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OrientDB Server Community Edition versions 2.0.0 through 2.0.14 OrientDB Server Community Edition versions 2.1.0 through 2.1.0

Description The issue concerns the JSONP endpoint in the Studio component, which does not properly restrict callback values. This allows remote attackers to conduct cross-site request forgery (CSRF) attacks and obtain sensitive information via a crafted HTTP request.

Recommendations For OrientDB Server Community Edition versions 2.0.0 through 2.0.14, update to version 2.0.15 or later. For OrientDB Server Community Edition versions 2.1.0 through 2.1.0, update to version 2.1.1 or later.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2015-2912

GHSA-P8WW-VV84-C2RM

Produtos afetados

Orientdb Server Community Edition

Referências · 6

• https://github.com/orientechnologies/orientdb · Nota
• https://github.com/orientechnologies/orientdb/issues/4824 · Aviso do Fabricante
• https://kb.cert.org/vuls/id/845332 · Nota
• https://github.com/advisories/GHSA-p8ww-vv84-c2rm · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-2912 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-p8ww-vv84-c2rm · Aviso do Fabricante