What is GHSA-v6wr-fch2-vm5w?

GHSA-v6wr-fch2-vm5w is a security advisory published by GitHub Security Advisories with Medium severity. OrientDB Server Community Edition uses insufficiently random values to generate session IDs

Which CVE IDs does GHSA-v6wr-fch2-vm5w cover?

GHSA-v6wr-fch2-vm5w covers the following CVE IDs: CVE-2015-2913. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-v6wr-fch2-vm5w?

GHSA-v6wr-fch2-vm5w has a CVSS v3 base score of 5.9, published by GitHub Security Advisories.

Which products are affected by GHSA-v6wr-fch2-vm5w?

GHSA-v6wr-fch2-vm5w affects 2 products, including: maven/com.orientechnologies:orientdb-server:\u003c 2.0.15; maven/com.orientechnologies:orientdb-server:= 2.1.0.

GHSA-v6wr-fch2-vm5wMediumCVSS 5.9

OrientDB Server Community Edition uses insufficiently random values to generate session IDs

Vendor

GitHub Security Advisories

Published

October 18, 2018

Last Modified

September 12, 2023

🔗 CVE IDs covered (1)

CVE-2015-2913 →

📋 Description

OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 improperly relies on the java.util.Random class for generation of random Session ID values in the server/network/protocol/http/OHttpSessionManager.java, which makes it easier for remote attackers to predict a value by determining the internal state of the PRNG in this class.

🎯 Affected products2

maven/com.orientechnologies:orientdb-server:< 2.0.15
maven/com.orientechnologies:orientdb-server:= 2.1.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2015-2913
https://github.com/orientechnologies/orientdb/commit/668ece96be210e742a4e2820a3085b215cf55104
https://github.com/advisories/GHSA-v6wr-fch2-vm5w
https://www.kb.cert.org/vuls/id/845332