CVE-2015-2912

NONE EPSS 67.4%
Published Dec 31, 201510y ago · Modified Jun 17, 20262w ago
Find Similar
Published Dec 31, 2015 10y ago
Last Modified Jun 17, 2026 2w ago

Description

The JSONP endpoint in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict callback values, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and obtain sensitive information, via a crafted HTTP request.

Threat Intelligence

EPSS Exploit Probability
67.4% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-352 Cross-Site Request Forgery (CSRF) Authentication

Affected Products 2

VendorProductVersionRange
orientdborientdb* ≤2.0.14
orientdborientdb2.1.0any

References 2

  • github.com https://github.com/orientechnologies/orientdb/issues/4824
    Vendor Advisory
  • kb.cert.org https://www.kb.cert.org/vuls/id/845332
    Third Party AdvisoryUS Government Resource

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.