PT-2026-21317 · Orientdb · Orientdb 3.0.17 Ga Community Edition

Ozer Goker · Publicado 2026-02-20 · Atualizado 2026-02-24 · CVE-2019-25447

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions OrientDB version 3.0.17 GA Community Edition

Description The software contains cross-site request forgery flaws that could allow attackers to perform unauthorized actions. This is achieved by creating malicious requests to API endpoints such as '/database/', '/command/', and '/document/'. Specifically, attackers can create or delete databases, modify schema classes, manage users, and create functions by sending authenticated requests without proper token validation. These issues are combined with reflected and stored cross-site scripting flaws in the web interface.

Recommendations Apply updates to address the identified cross-site request forgery and cross-site scripting issues.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2019-25447

Produtos afetados

Orientdb 3.0.17 Ga Community Edition

Referências · 6

• 🔥 https://exploit-db.com/exploits/46517 · Exploit
• https://t.me/cveNotify/153010 · Publicação no Telegram
• https://orientdb.dev · Nota
• https://vulncheck.com/advisories/orientdb-cross-site-request-forgery · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-25447 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-25447 · Aviso do Fabricante