OrientDB Studio web management interface is vulnerable to clickjacking attacks

MEDIUM 6.1CVE-2015-2918 · GHSA-g4gg-9f62-jfph · Published 31/12/2015 · updated 17/06/2026

In short

CVE-2015-2918 is a MEDIUM (CVSS 6.1) vulnerability affecting com.orientechnologies:orientdb-studio, orientdb (orientdb).
Chance of exploitation in the next 30 days (EPSS): 0.74%, higher than 54.8% of all vulnerabilities.
Fix: update to 2.1.1, 2.0.15 or later.

Package	Affected versions	Patched versions
com.orientechnologies:orientdb-studio Maven	`≥ 2.1.0, < 2.1.1< 2.0.15`	`2.1.12.0.15`
orientdb orientdb	`= 2.0.14= 2.1.0`	No fix yet

Description

The Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict use of FRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2015-2918 · ADVISORY
GitHub Advisory GHSA-g4gg-9f62-jfph · ADVISORY
kb.cert.org/vuls/id/845332 · WEB

More vulnerabilities in com.orientechnologies:orientdb-studio

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

com.orientechnologies:orientdb-studio

Maven

≥ 2.1.0, < 2.1.1< 2.0.15

2.1.12.0.15

orientdb

= 2.0.14= 2.1.0

No fix yet

Description

NVD description