PT-2015-5971 · Orientdb · Orientdb Server Community Edition

Raffaela Frank · Publicado 2015-12-31 · Atualizado 2018-10-18 · CVE-2015-2913

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OrientDB Server Community Edition versions 2.0.0 through 2.0.14 OrientDB Server Community Edition versions 2.1.x prior to 2.1.1

Description The issue arises from the improper reliance on the java.util.Random class for generating random Session ID values in the server/network/protocol/http/OHttpSessionManager.java file. This makes it easier for remote attackers to predict a Session ID value by determining the internal state of the PRNG in this class.

Recommendations For OrientDB Server Community Edition versions 2.0.0 through 2.0.14, update to version 2.0.15 or later. For OrientDB Server Community Edition versions 2.1.x prior to 2.1.1, update to version 2.1.1 or later.

Correção

Use of Insufficiently Random Values

Information Disclosure

Enumeração de Fraquezas

CWE-330

CWE-200

Identificadores relacionados

CVE-2015-2913

GHSA-V6WR-FCH2-VM5W

Produtos afetados

Orientdb Server Community Edition

Referências · 6

• https://github.com/orientechnologies/orientdb · Nota
• https://github.com/orientechnologies/orientdb/commit/668ece96be210e742a4e2820a3085b215cf55104 · Aviso do Fabricante
• https://github.com/advisories/GHSA-v6wr-fch2-vm5w · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-2913 · Nota de Segurança
• https://kb.cert.org/vuls/id/845332 · Nota
• https://osv.dev/vulnerability/GHSA-v6wr-fch2-vm5w · Aviso do Fabricante