Vulnerability record · CVE-2015-2913 · published 31 December 2015

CVE-2015-2913: Orientdb information exposure vulnerability

Orientdb · Orientdb

server/network/protocol/http/OHttpSessionManager.java in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 improperly relies on the java.util.Random class for generation of random Session ID values, which makes it easier for remote attackers to predict a value by determining the internal state of the PRNG in this class.

5.9 CVSS 3.0 Medium EPSS 1.9% · top 21.6% CWE-200 · Information exposure

5.9CVSS 3.0 base score, v2 4.3

1.9%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

4References

17 Jun 2026Last modified by NVD

Description

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Orientdb Orientdb

References

Link	Tags
https://github.com/orientechnologies/orientdb/commit/668ece96be210e742a4e2820a3085b215cf55104	Vendor Advisory
https://www.kb.cert.org/vuls/id/845332	Third Party AdvisoryUS Government Resource
https://github.com/orientechnologies/orientdb/commit/668ece96be210e742a4e2820a3085b215cf55104	Vendor Advisory
https://www.kb.cert.org/vuls/id/845332	Third Party AdvisoryUS Government Resource

Track CVE-2015-2913 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2017-11467OrientDB privilege bypass in where/fetchplan/order by leads to OS command executionOrientDB through 2.2.22 fails to enforce privilege requirements when the where, fetchplan, or order by clauses are used, letting a remote attacker by…EPSS 73%analysed20 Jul 2017 8.8CVE-2015-2912Orientdb cross-site request forgery vulnerabilityThe JSONP endpoint in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict callb…EPSS 1.3%31 Dec 2015 6.1CVE-2015-2918Orientdb improper input validation vulnerabilityThe Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict use of FRAME elements, whic…EPSS 0.74%31 Dec 2015 5.3CVE-2019-25447Orientdb cross-site request forgery vulnerabilityOrientDB 3.0.17 GA Community Edition contains cross-site request forgery vulnerabilities that allow attackers to perform unauthorized actions by craf…EPSS 0.14%20 Feb 2026 5.1CVE-2019-25448Orientdb cross-site scripting vulnerabilityOrientDB 3.0.17 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by creating user…EPSS 0.26%20 Feb 2026 5.1CVE-2019-25449Orientdb cross-site scripting vulnerabilityOrientDB 3.0.17 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted JSON …EPSS 0.23%20 Feb 2026 5.9CVE-2025-68686FortiOS symbolic link patch bypass exposes sensitive informationFortiOS contains an information exposure flaw (CWE-200) that lets a remote unauthenticated attacker bypass the patch for the symbolic link persistenc…KEVEPSS 30%analysed10 Feb 2026 7.5CVE-2026-20133Cisco Catalyst SD-WAN Manager insufficient file system restrictions expose dataCisco Catalyst SD-WAN Software has insufficient file system restrictions that let an attacker read sensitive files on the underlying operating system…KEVEPSS 32%analysed25 Feb 2026

Source: NIST National Vulnerability Database (record CVE-2015-2913), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.