CVE-2015-2913

Description

server/network/protocol/http/OHttpSessionManager.java in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 improperly relies on the java.util.Random class for generation of random Session ID values, which makes it easier for remote attackers to predict a value by determining the internal state of the PRNG in this class.

Risk Information

Base Score

5.9

MODERATE

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score

Exploitation Probability

0.586

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2015-2913 are fixed in Orient-Technologies-orientdb-server 2.0.15	Windows
Vulnerabilities CVE-2015-2913 are fixed in Orient-Technologies-orientdb-server 2.1.1	Windows
Vulnerabilities CVE-2015-2913 are fixed in Orient-Technologies-orientdb-server for Linux 2.0.15	Linux
Vulnerabilities CVE-2015-2913 are fixed in Orient-Technologies-orientdb-server for Linux 2.1.1	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234