CVE-2015-2913

MEDIUM

OrientDB Server Community Edition <2.0.15 and 2.1.x <2.1.1 - Information Disclosure

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2015-2913. PoCs published by dawetmaster, andikahilmy.

AI-analyzed exploit summary This repository appears to be a fork or snapshot of the OrientDB project itself, not an exploit PoC. It contains source code files and build scripts but no exploit code or technical analysis related to CVE-2015-2913.

Description

server/network/protocol/http/OHttpSessionManager.java in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 improperly relies on the java.util.Random class for generation of random Session ID values, which makes it easier for remote attackers to predict a value by determining the internal state of the PRNG in this class.

Exploits (2)

nomisec STUB
by dawetmaster · poc
https://github.com/dawetmaster/CVE-2015-2913-orientdb-vulnerable

This repository appears to be a fork or snapshot of the OrientDB project itself, not an exploit PoC. It contains source code files and build scripts but no exploit code or technical analysis related to CVE-2015-2913.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: OrientDB
No auth needed
devstral-2 · analyzed Mar 14, 2026 Full analysis →
nomisec STUB
by andikahilmy · poc
https://github.com/andikahilmy/CVE-2015-2913-orientdb-vulnerable

This repository appears to be a fork of the OrientDB project itself rather than an exploit PoC. It contains the full OrientDB source code but lacks any exploit-specific code or technical analysis related to CVE-2015-2913.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: OrientDB
No auth needed
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (2)

Core 2
Core References
Third Party Advisory, US Government Resource third-party-advisory x_refsource_cert-vn
https://www.kb.cert.org/vuls/id/845332

Scores

CVSS v3 5.9
EPSS 0.0050
EPSS Percentile 66.4%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-200
Status published
Products (3)
com.orientechnologies/orientdb-server 0 - 2.0.15Maven
orientdb/orientdb 2.0.14
orientdb/orientdb 2.1.0
Published Dec 31, 2015
Tracked Since Feb 18, 2026