Read the docs
TI-2015-02570 Aliases CVE-2015-2912GHSA-p8ww-vv84-c2rm

The JSONP endpoint in the Studio component in OrientDB Server Community Edition before…

Priority MEDIUM 41CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-352.

Summary

The JSONP endpoint in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict callback values, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and obtain sensitive information, via a crafted HTTP request.

Why it matters now

EPSS 0.01321 71st percentileScored 2026-11-07
Fix Fixed com.orientechnologies:orientdb-studio (Maven): 2.0.15, 2.1.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—com.orientechnologies:orientdb-studio (Maven)before 2.0.152.0.15Patch availableGHSA-p8ww-vv84-c2rm
—com.orientechnologies:orientdb-studio (Maven)2.1.0 to before 2.1.12.1.1Patch availableGHSA-p8ww-vv84-c2rm
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • com.orientechnologies:orientdb-studio (Maven) Vendor— Affected before 2.0.15 Fixed in 2.0.15 Patch available GHSA-p8ww-vv84-c2rm
  • com.orientechnologies:orientdb-studio (Maven) Vendor— Affected 2.1.0 to before 2.1.1 Fixed in 2.1.1 Patch available GHSA-p8ww-vv84-c2rm

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:orientdb:orientdb:*:*:*:*:community:*:*:*up to 2.0.14VulnerableOrientdb
cpe:2.3:a:orientdb:orientdb:2.1.0:*:*:*:community:*:*:*2.1.0VulnerableOrientdb
  • cpe:2.3:a:orientdb:orientdb:*:*:*:*:community:*:*:* Versions up to 2.0.14 Vulnerable ·Orientdb
  • cpe:2.3:a:orientdb:orientdb:2.1.0:*:*:*:community:*:*:* Versions 2.1.0 Vulnerable ·Orientdb

Remediation

  • Fix · GHSA-p8ww-vv84-c2rm com.orientechnologies:orientdb-studio (Maven) Fixed in 2.0.15 Advisory →
  • Fix · GHSA-p8ww-vv84-c2rm com.orientechnologies:orientdb-studio (Maven) Fixed in 2.1.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-2912
  2. 2026-10-03 Alias added: GHSA-p8ww-vv84-c2rm

References

Advisory 4

Other 1

  • TI-2017-08483 OrientDB through 2.2.22 does not enforce privilege requirements during "where" or… CVSS 3.0CRITICAL 9.8
  • TI-2019-15500 OrientDB 3.0.17 Cross-Site Request Forgery CVSS 4.0MEDIUM 5.3
  • TI-2019-15502 OrientDB 3.0.17 Reflected Cross-Site Scripting via document endpoint CVSS 4.0MEDIUM 5.1
  • TI-2019-15501 OrientDB 3.0.17 Stored Cross-Site Scripting via User Creation CVSS 4.0MEDIUM 5.1
  • TI-2015-02571 server/network/protocol/http/OHttpSessionManager.java in the Studio component in OrientDB… CVSS 3.0MEDIUM 5.9
  • TI-2015-02576 The Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before… CVSS 3.0MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences