GitHub Advisoryadvisory · Maven

GHSA-p8ww-vv84-c2rm OrientDB-Server vulnerable to Cross-Site Request Forgery

HIGH Published 2018-10-18 Modified 2022-09-13 Official page ↗
Aliases
CVE-2015-2912
Ecosystem
Maven
Packages
com.orientechnologies:orientdb-studio
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2020-06-16

Affected packages

• Maven com.orientechnologies:orientdb-studio: < 2.0.15 → fixed in 2.0.15 • Maven com.orientechnologies:orientdb-studio: >= 2.1.0, < 2.1.1 → fixed in 2.1.1

Description

The JSONP endpoint in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict callback values, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and obtain sensitive information, via a crafted HTTP request.

Related

Alias · CVE (1)

  • CVE-2015-2912 The JSONP endpoint in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References