CVE-2019-25447

OrientDB 3.0.17 Cross-Site Request Forgery

CVSS 5.3 MEDIUMEPSS 0.1%CWE-352

Vexday Risk Score

13Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 5.3EPSS 0.1%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

20 feb 2026Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

OrientDB 3.0.17 GA Community Edition contains cross-site request forgery vulnerabilities that allow attackers to perform unauthorized actions by crafting malicious requests to endpoints like /database/, /command/, and /document/. Attackers can create or delete databases, modify schema classes, manage users, and create functions by sending authenticated requests without token validation, combined with reflected and stored cross-site scripting vulnerabilities in the web interface.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L

Productos afectados

Orientdb · OrientDB

Referencias

https://orientdb.dev/https://www.exploit-db.com/exploits/46517 https://www.vulncheck.com/advisories/orientdb-cross-site-request-forgery