Vulnerability CVE-2015-2913
Published: 2015-12-31

Description:
server/network/protocol/http/OHttpSessionManager.java in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 improperly relies on the java.util.Random class for generation of random Session ID values, which makes it easier for remote attackers to predict a value by determining the internal state of the PRNG in this class.

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4.3/10
2.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None
Affected software
Orientdb -> Orientdb 

 References:
https://www.kb.cert.org/vuls/id/845332
https://github.com/orientechnologies/orientdb/commit/668ece96be210e742a4e2820a3085b215cf55104
Copyright 2024, cxsecurity.com

 

Back to Top