PT-2026-21317 · Orientdb · Orientdb 3.0.17 Ga Community Edition

Ozer Goker · Published 2026-02-20 · Updated 2026-02-24 · CVE-2019-25447

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions OrientDB version 3.0.17 GA Community Edition

Description The software contains cross-site request forgery flaws that could allow attackers to perform unauthorized actions. This is achieved by creating malicious requests to API endpoints such as '/database/', '/command/', and '/document/'. Specifically, attackers can create or delete databases, modify schema classes, manage users, and create functions by sending authenticated requests without proper token validation. These issues are combined with reflected and stored cross-site scripting flaws in the web interface.

Recommendations Apply updates to address the identified cross-site request forgery and cross-site scripting issues.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-25447

Affected Products

Orientdb 3.0.17 Ga Community Edition

References · 6

• 🔥 https://exploit-db.com/exploits/46517 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25447 · Security Note
• https://osv.dev/vulnerability/CVE-2019-25447 · Vendor Advisory
• https://t.me/cveNotify/153010 · Telegram Post
• https://orientdb.dev · Note
• https://vulncheck.com/advisories/orientdb-cross-site-request-forgery · Note