OrientDB-Server vulnerable to Cross-Site Request Forgery
High severity
GitHub Reviewed
Published
Oct 18, 2018
to the GitHub Advisory Database
•
Updated Jan 8, 2023
Package
Affected versions
< 2.0.15
= 2.1.0
Patched versions
2.0.15
2.1.1
Description
Published to the GitHub Advisory Database
Oct 18, 2018
Reviewed
Jun 16, 2020
Last updated
Jan 8, 2023
The JSONP endpoint in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict callback values, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and obtain sensitive information, via a crafted HTTP request.
References