What is GHSA-p8ww-vv84-c2rm?

GHSA-p8ww-vv84-c2rm is a security advisory published by GitHub Security Advisories with High severity. OrientDB-Server vulnerable to Cross-Site Request Forgery

Which CVE IDs does GHSA-p8ww-vv84-c2rm cover?

GHSA-p8ww-vv84-c2rm covers the following CVE IDs: CVE-2015-2912. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-p8ww-vv84-c2rm?

GHSA-p8ww-vv84-c2rm has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-p8ww-vv84-c2rm?

GHSA-p8ww-vv84-c2rm affects 2 products, including: maven/com.orientechnologies:orientdb-studio:\u003c 2.0.15; maven/com.orientechnologies:orientdb-studio:= 2.1.0.

GHSA-p8ww-vv84-c2rmHighCVSS 8.8

OrientDB-Server vulnerable to Cross-Site Request Forgery

Vendor

GitHub Security Advisories

Published

October 18, 2018

Last Modified

January 8, 2023

🔗 CVE IDs covered (1)

CVE-2015-2912 →

📋 Description

The JSONP endpoint in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict callback values, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and obtain sensitive information, via a crafted HTTP request.

🎯 Affected products2

maven/com.orientechnologies:orientdb-studio:< 2.0.15
maven/com.orientechnologies:orientdb-studio:= 2.1.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2015-2912
https://github.com/orientechnologies/orientdb/issues/4824
https://github.com/advisories/GHSA-p8ww-vv84-c2rm
https://www.kb.cert.org/vuls/id/845332