OrientDB vulnerable to Improper Privilage Management leading to arbitrary command injection

CRITIQUE 9.8CVE-2017-11467 · GHSA-xm6r-4466-mr74 · Published 20/07/2017 · updated 17/06/2026

En bref

CVE-2017-11467 est une vulnérabilité CRITIQUE (CVSS 9.8) touchant com.orientechnologies:orientdb-core, orientdb (orientdb).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 73.1%, plus élevée que 99.5% des vulnérabilités.
Correctif : mettre à jour vers 2.2.23 ou plus récent.

Package	Affected versions	Patched versions
com.orientechnologies:orientdb-core Maven	`< 2.2.23`	`2.2.23`
orientdb orientdb	`≤ 2.2.22`	No fix yet

Description

OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote attackers to execute arbitrary OS commands via a crafted request.

NVD description

OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote attackers to execute arbitrary OS commands via a crafted request.

References

nvd.nist.gov/vuln/detail/CVE-2017-11467 · ADVISORY
GitHub Advisory GHSA-xm6r-4466-mr74 · ADVISORY
orientechnologies/orientdb · PACKAGE
orientechnologies/orientdb · WEB
web.archive.org/web/20210403135751/http://www.heavensec.org · WEB
heavensec.org · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free