CVE-2015-2913

low-risk
Published 2015-12-31

server/network/protocol/http/OHttpSessionManager.java in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 improperly relies on the java.util.Random class for generation of random Session ID values, which makes it easier for remote attackers to predict a value by determining the internal state of the PRNG in this class.

Do I need to act?

-
0.37% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.9/10 Medium
NETWORK / HIGH complexity

Affected Products (2)

Orientdb
Orientdb

Affected Vendors

Orientdb

References (4)

Vendor Advisory https://github.com/orientechnologies/orientdb/commit/668ece96be210e742a4e2820a30...
Third Party Advisory https://www.kb.cert.org/vuls/id/845332
Vendor Advisory https://github.com/orientechnologies/orientdb/commit/668ece96be210e742a4e2820a30...
Third Party Advisory https://www.kb.cert.org/vuls/id/845332
26
/ 100
low-risk
Severity 18/34 · Moderate
Exploitability 1/34 · Minimal
Exposure 7/34 · Low