GitHub Advisoryadvisory · Maven

GHSA-xm6r-4466-mr74 OrientDB vulnerable to Improper Privilage Management leading to arbitrary command injection

CRITICAL Published 2018-10-18 Modified 2024-02-20 Official page ↗
Aliases
CVE-2017-11467
Ecosystem
Maven
Packages
com.orientechnologies:orientdb-core
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-269
Reviewed
2020-06-16

Affected packages

• Maven com.orientechnologies:orientdb-core: < 2.2.23 → fixed in 2.2.23

Description

OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote attackers to execute arbitrary OS commands via a crafted request.

Related

Alias · CVE (1)

  • CVE-2017-11467 OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote… vulnerability

Weakness · CWE (1)

  • CWE-269 Improper Privilege Management weakness

References