OrientDB 2.2.x Remote Code Execution

This module leverages a privilege escalation on OrientDB to execute unsandboxed OS commands. All versions from 2.2.2 up to 2.2.22 should be vulnerable. Module Options msf use exploit/multi/http/orientdb/exec msf undefinedexec show actions ...actions... msf undefinedexec set ACTION msf undefinedex...

PT-2017-2829 · Orientdb · Orientdb

Name of the Vulnerable Software and Affected Versions: OrientDB versions prior to 2.2.22 Description: The issue is related to insufficient access control in certain functions, specifically where, fetchplan, and order by. This allows remote attackers to execute arbitrary OS commands via a crafted...

Pornhub: Unsecured DB instance

The researcher identified vulnerable OrientDB server instances on our infrastructure. The DB servers were found to be vulnerable to script based remote code execution leading to privilege escalation. Two servers running OrientDB were identified, with default login/password combinations. Upon...

OrientDB Server < 2.0.15, 2.1.x < 2.1.1 'Studio component' Multiple Vulnerabilities

OrientDB server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:orientdb:orientdb";...

OrientDB Server < 2.0.15, 2.1.x < 2.1.1 Clickjacking Vulnerability

OrientDB server is prone to a clickjacking vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:orientdb:orientdb";...

CVE-2015-2918

The Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict use of FRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site...

CVE-2015-2913

server/network/protocol/http/OHttpSessionManager.java in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 improperly relies on the java.util.Random class for generation of random Session ID values, which makes it easier for remote attackers to predict...

CVE-2015-2912

The JSONP endpoint in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict callback values, which allows remote attackers to conduct cross-site request forgery CSRF attacks, and obtain sensitive information, via a crafted HTTP...

Cross site request forgery (csrf)

The JSONP endpoint in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict callback values, which allows remote attackers to conduct cross-site request forgery CSRF attacks, and obtain sensitive information, via a crafted HTTP...

Design/Logic Flaw

server/network/protocol/http/OHttpSessionManager.java in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 improperly relies on the java.util.Random class for generation of random Session ID values, which makes it easier for remote attackers to predict...

Code injection

The Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict use of FRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site...

com.orientechnologies:orientdb-community (2.1.0), com.orientechnologies:orientdb-distributed (2.1.0) +4 more potentially affected by CVE-2015-2913 via com.orientechnologies:orientdb-server (2.1.0)

com.orientechnologies:orientdb-server MAVEN version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.orientechnologies:orientdb-server and may be impacted: - com.orientechnologies:orientdb-community 2.1.0 -...

CVE-2015-2918

The Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict use of FRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site...

CVE-2015-2913

server/network/protocol/http/OHttpSessionManager.java in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 improperly relies on the java.util.Random class for generation of random Session ID values, which makes it easier for remote attackers to predict...

CVE-2015-2912

The JSONP endpoint in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict callback values, which allows remote attackers to conduct cross-site request forgery CSRF attacks, and obtain sensitive information, via a crafted HTTP...

CVE-2015-2913

server/network/protocol/http/OHttpSessionManager.java in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 improperly relies on the java.util.Random class for generation of random Session ID values, which makes it easier for remote attackers to predict...

CVE-2015-2912

The JSONP endpoint in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict callback values, which allows remote attackers to conduct cross-site request forgery CSRF attacks, and obtain sensitive information, via a crafted HTTP...

com.orientechnologies:orientdb (>=1.0rc9, <=1.5.1), com.orientechnologies:orientdb-community (>=1.6.5, <=2.0.14) +23 more potentially affected by CVE-2015-2913 via com.orientechnologies:orientdb-server (>=1.0rc9, <=2.0.14)

com.orientechnologies:orientdb-server MAVEN version =1.0rc9, =1.0rc9, =1.6.5, =1.1.0, =2.0-m3, =1.1.0, =2.0-m3, =1.7, =1.0, =0.1.17, =0.2.14 - org.ops4j.orient.samples:orient-sample1 0.3.0 - org.ops4j.orient.samples:orient-sample2 0.3.0 - org.ops4j.orient:orient-ra 0.3.0 -...

CVE-2015-2913

OrientDB Server Community Edition prior to 2.0.15 and 2.1.x prior to 2.1.1 is affected by CVE-2015-2913 due to using java.util.Random for Session ID generation in server/network/protocol/http/OHttpSessionManager.java, which can allow remote attackers to predict session IDs. The issue is documente...

CVE-2015-2912

CVE-2015-2912 affects OrientDB Studio (Community Edition) via its JSONP endpoint. The vulnerability allows CSRF by not properly restricting JSONP callback values, enabling an unauthenticated or remote attacker to perform actions and potentially access sensitive data. Affected versions are OrientD...