Read the docs
TI-2015-02576 Aliases CVE-2015-2918GHSA-g4gg-9f62-jfph

The Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before…

Priority LOW 29CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.

Summary

The Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict use of FRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.

Why it matters now

EPSS 0.00744 54th percentileScored 2026-11-07
Fix Fixed com.orientechnologies:orientdb-studio (Maven): 2.0.15, 2.1.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—com.orientechnologies:orientdb-studio (Maven)before 2.0.152.0.15Patch availableGHSA-g4gg-9f62-jfph
—com.orientechnologies:orientdb-studio (Maven)2.1.0 to before 2.1.12.1.1Patch availableGHSA-g4gg-9f62-jfph
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • com.orientechnologies:orientdb-studio (Maven) Vendor— Affected before 2.0.15 Fixed in 2.0.15 Patch available GHSA-g4gg-9f62-jfph
  • com.orientechnologies:orientdb-studio (Maven) Vendor— Affected 2.1.0 to before 2.1.1 Fixed in 2.1.1 Patch available GHSA-g4gg-9f62-jfph

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:orientdb:orientdb:2.0.14:*:*:*:community:*:*:*2.0.14VulnerableOrientdb
cpe:2.3:a:orientdb:orientdb:2.1.0:*:*:*:community:*:*:*2.1.0VulnerableOrientdb
  • cpe:2.3:a:orientdb:orientdb:2.0.14:*:*:*:community:*:*:* Versions 2.0.14 Vulnerable ·Orientdb
  • cpe:2.3:a:orientdb:orientdb:2.1.0:*:*:*:community:*:*:* Versions 2.1.0 Vulnerable ·Orientdb

Remediation

  • Fix · GHSA-g4gg-9f62-jfph com.orientechnologies:orientdb-studio (Maven) Fixed in 2.0.15 Advisory →
  • Fix · GHSA-g4gg-9f62-jfph com.orientechnologies:orientdb-studio (Maven) Fixed in 2.1.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-2918
  2. 2026-10-03 Alias added: GHSA-g4gg-9f62-jfph

References

Advisory 3

  • TI-2017-08483 OrientDB through 2.2.22 does not enforce privilege requirements during "where" or… CVSS 3.0CRITICAL 9.8
  • TI-2019-15500 OrientDB 3.0.17 Cross-Site Request Forgery CVSS 4.0MEDIUM 5.3
  • TI-2019-15502 OrientDB 3.0.17 Reflected Cross-Site Scripting via document endpoint CVSS 4.0MEDIUM 5.1
  • TI-2019-15501 OrientDB 3.0.17 Stored Cross-Site Scripting via User Creation CVSS 4.0MEDIUM 5.1
  • TI-2015-02570 The JSONP endpoint in the Studio component in OrientDB Server Community Edition before… CVSS 3.0HIGH 8.8
  • TI-2015-02571 server/network/protocol/http/OHttpSessionManager.java in the Studio component in OrientDB… CVSS 3.0MEDIUM 5.9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences