Cross-Site Request Forgery Vulnerability in OrientDB by OrientDB

CVE-2019-25447

What is CVE-2019-25447?

OrientDB 3.0.17 GA Community Edition has vulnerabilities that allow attackers to exploit cross-site request forgery (CSRF) flaws. By crafting specific malicious requests targeting endpoints such as /database/, /command/, and /document/, an unauthorized user can execute sensitive actions without proper authentication. This lack of token validation can lead to significant security issues, enabling attackers to create or delete databases, modify schema classes, manage user accounts, and develop functions through authenticated requests. Additionally, these vulnerabilities may be compounded by reflected and stored cross-site scripting issues within the web interface, increasing the risk of exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References