CVE-2015-2913

MEDIUM

OrientDB Server Community Edition <2.0.15 and 2.1.x <2.1.1 - Info D...

Title source: llm

Description

server/network/protocol/http/OHttpSessionManager.java in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 improperly relies on the java.util.Random class for generation of random Session ID values, which makes it easier for remote attackers to predict a value by determining the internal state of the PRNG in this class.

Exploits (1)

nomisec STUB
by andikahilmy · poc
https://github.com/andikahilmy/CVE-2015-2913-orientdb-vulnerable

References (2)

Scores

CVSS v3 5.9
EPSS 0.0059
EPSS Percentile 68.7%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Classification

CWE
CWE-200
Status draft

Affected Products (3)

orientdb/orientdb
orientdb/orientdb
com.orientechnologies/orientdb-server < 2.0.15Maven

Timeline

Published Dec 31, 2015
Tracked Since Feb 18, 2026