GitHub Advisoryadvisory · Maven

GHSA-g4gg-9f62-jfph OrientDB Studio web management interface is vulnerable to clickjacking attacks

MEDIUM Published 2018-10-18 Modified 2023-09-29 Official page ↗
Aliases
CVE-2015-2918
Ecosystem
Maven
Packages
com.orientechnologies:orientdb-studio
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-20
Reviewed
2020-06-16

Affected packages

• Maven com.orientechnologies:orientdb-studio: < 2.0.15 → fixed in 2.0.15 • Maven com.orientechnologies:orientdb-studio: >= 2.1.0, < 2.1.1 → fixed in 2.1.1

Description

The Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict use of FRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.

Related

Alias · CVE (1)

  • CVE-2015-2918 The Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict use of FRAME… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References