VULNERABILITY INTELLIGENCE

CVE-2015-2912

CVSS score8.8 HIGH

EPSS probability1.32%

CISA KEVNot currently listed

Published2015-12-31

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

The JSONP endpoint in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict callback values, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and obtain sensitive information, via a crafted HTTP request.

Weakness classification

CWE-352: Cross-Site Request Forgery (CSRF)

Primary references

cret@cert.org — Vendor Advisory
cret@cert.org — Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, US Government Resource