Read the docs
TI-2017-08483 Aliases CVE-2017-11467GHSA-xm6r-4466-mr74

OrientDB through 2.2.22 does not enforce privilege requirements during "where" or…

Priority HIGH 80CWE-269Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-269.

Summary

OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote attackers to execute arbitrary OS commands via a crafted request.

Why it matters now

EPSS 0.73071 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed com.orientechnologies:orientdb-core (Maven): 2.2.23

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—com.orientechnologies:orientdb-core (Maven)before 2.2.232.2.23Patch availableGHSA-xm6r-4466-mr74
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • com.orientechnologies:orientdb-core (Maven) Vendor— Affected before 2.2.23 Fixed in 2.2.23 Patch available GHSA-xm6r-4466-mr74

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:orientdb:orientdb:*:*:*:*:*:*:*:*up to 2.2.22VulnerableOrientdb
  • cpe:2.3:a:orientdb:orientdb:*:*:*:*:*:*:*:* Versions up to 2.2.22 Vulnerable ·Orientdb

Remediation

  • Fix · GHSA-xm6r-4466-mr74 com.orientechnologies:orientdb-core (Maven) Fixed in 2.2.23 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-11467
  2. 2026-10-03 Alias added: GHSA-xm6r-4466-mr74

References

Exploit 1

Advisory 3

Other 2

  • TI-2019-15500 OrientDB 3.0.17 Cross-Site Request Forgery CVSS 4.0MEDIUM 5.3
  • TI-2019-15502 OrientDB 3.0.17 Reflected Cross-Site Scripting via document endpoint CVSS 4.0MEDIUM 5.1
  • TI-2019-15501 OrientDB 3.0.17 Stored Cross-Site Scripting via User Creation CVSS 4.0MEDIUM 5.1
  • TI-2015-02570 The JSONP endpoint in the Studio component in OrientDB Server Community Edition before… CVSS 3.0HIGH 8.8
  • TI-2015-02571 server/network/protocol/http/OHttpSessionManager.java in the Studio component in OrientDB… CVSS 3.0MEDIUM 5.9
  • TI-2015-02576 The Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before… CVSS 3.0MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences