OrientDB vulnerable to Improper Privilage Management leading to arbitrary command injection

CRITICAL 9.8CVE-2017-11467 · GHSA-xm6r-4466-mr74 · Published 20/07/2017 · updated 17/06/2026

Package	Affected versions	Patched versions
com.orientechnologies:orientdb-core Maven	`< 2.2.23`	`2.2.23`
orientdb orientdb	`≤ 2.2.22`	No fix yet

Description

OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote attackers to execute arbitrary OS commands via a crafted request.

NVD description

OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote attackers to execute arbitrary OS commands via a crafted request.

References

nvd.nist.gov/vuln/detail/CVE-2017-11467 · ADVISORY
GitHub Advisory GHSA-xm6r-4466-mr74 · ADVISORY
orientechnologies/orientdb · PACKAGE
orientechnologies/orientdb · WEB
web.archive.org/web/20210403135751/http://www.heavensec.org · WEB
heavensec.org · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free