Read the docs
TI-2015-02571 Aliases CVE-2015-2913GHSA-v6wr-fch2-vm5w

server/network/protocol/http/OHttpSessionManager.java in the Studio component in OrientDB…

Priority LOW 30CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

server/network/protocol/http/OHttpSessionManager.java in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 improperly relies on the java.util.Random class for generation of random Session ID values, which makes it easier for remote attackers to predict a value by determining the internal state of the PRNG in this class.

Why it matters now

EPSS 0.0186 79th percentileScored 2026-11-07
Fix Fixed com.orientechnologies:orientdb-server (Maven): 2.0.15, 2.1.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—com.orientechnologies:orientdb-server (Maven)before 2.0.152.0.15Patch availableGHSA-v6wr-fch2-vm5w
—com.orientechnologies:orientdb-server (Maven)2.1.0 to before 2.1.12.1.1Patch availableGHSA-v6wr-fch2-vm5w
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • com.orientechnologies:orientdb-server (Maven) Vendor— Affected before 2.0.15 Fixed in 2.0.15 Patch available GHSA-v6wr-fch2-vm5w
  • com.orientechnologies:orientdb-server (Maven) Vendor— Affected 2.1.0 to before 2.1.1 Fixed in 2.1.1 Patch available GHSA-v6wr-fch2-vm5w

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:orientdb:orientdb:2.0.14:*:*:*:community:*:*:*2.0.14VulnerableOrientdb
cpe:2.3:a:orientdb:orientdb:2.1.0:*:*:*:community:*:*:*2.1.0VulnerableOrientdb
  • cpe:2.3:a:orientdb:orientdb:2.0.14:*:*:*:community:*:*:* Versions 2.0.14 Vulnerable ·Orientdb
  • cpe:2.3:a:orientdb:orientdb:2.1.0:*:*:*:community:*:*:* Versions 2.1.0 Vulnerable ·Orientdb

Remediation

  • Fix · GHSA-v6wr-fch2-vm5w com.orientechnologies:orientdb-server (Maven) Fixed in 2.0.15 Advisory →
  • Fix · GHSA-v6wr-fch2-vm5w com.orientechnologies:orientdb-server (Maven) Fixed in 2.1.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-2913
  2. 2026-10-03 Alias added: GHSA-v6wr-fch2-vm5w

References

Advisory 4

Other 1

  • TI-2017-08483 OrientDB through 2.2.22 does not enforce privilege requirements during "where" or… CVSS 3.0CRITICAL 9.8
  • TI-2019-15500 OrientDB 3.0.17 Cross-Site Request Forgery CVSS 4.0MEDIUM 5.3
  • TI-2019-15502 OrientDB 3.0.17 Reflected Cross-Site Scripting via document endpoint CVSS 4.0MEDIUM 5.1
  • TI-2019-15501 OrientDB 3.0.17 Stored Cross-Site Scripting via User Creation CVSS 4.0MEDIUM 5.1
  • TI-2015-02570 The JSONP endpoint in the Studio component in OrientDB Server Community Edition before… CVSS 3.0HIGH 8.8
  • TI-2015-02576 The Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before… CVSS 3.0MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences