CVE-2017-11467

creationtimestamp| type| source ---|---|--- 2018-02-02 15:26:37+00:00| exploited| https://t.me/SecLabNews/1444 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/orientdbexec.rb 2020-10-09 15:17:37+00:00| seen|...

VulnCheck KEV: CVE-2017-11467

OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote attackers to execute arbitrary OS commands via a crafted request...

CVE-2017-11467

OrientDB 2.2.x is affected by CVE-2017-11467: the product fails to enforce privilege requirements during where, fetchplan, and order by operations, enabling remote attackers to run arbitrary OS commands via a crafted request. Impact is consistent with a high-severity command-injection-style vulne...

OrientDB 2.2.x Remote Code Execution

This module leverages a privilege escalation on OrientDB to execute unsandboxed OS commands. All versions from 2.2.2 up to 2.2.22 should be vulnerable. Module Options msf use exploit/multi/http/orientdb/exec msf undefinedexec show actions ...actions... msf undefinedexec set ACTION msf undefinedex...

OrientDB - Code Execution

OrientDB - Code Execution Vulnerability Summary The following advisory reports a vulnerability in OrientDB which allows users of the product to cause it to execute code. OrientDB is a Distributed Graph Database engine with the flexibility of a Document Database all in one product. The first and...

OrientDB - Code Execution

Vulnerability Summary The following advisory reports a vulnerability in OrientDB which allows users of the product to cause it to execute code. OrientDB is a Distributed Graph Database engine with the flexibility of a Document Database all in one product. The first and best scalable,...