CVE-2019-25447

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2019-25447
OrientDB 3.0.17 GA Community Edition contains cross-site request forgery vulnerabilities that allow attackers to perform unauthorized actions by crafting malicious requests to endpoints like /database/, /command/, and /document/. Attackers can create or delete databases, modify schema classes, manage users, and create functions by sending authenticated requests without token validation, combined with reflected and stored cross-site scripting vulnerabilities in the web interface.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://orientdb.dev/ Product
https://www.exploit-db.com/exploits/46517 Exploit VDB Entry
https://www.vulncheck.com/advisories/orientdb-cross-site-request-forgery Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:orientdb:orientdb:3.0.17:*:*:*:*:*:*:*
History

17 Jun 2026, 02:32

Type Values Removed Values Added
Summary
  • (es) OrientDB 3.0.17 GA Community Edition contiene vulnerabilidades de falsificación de petición en sitios cruzados que permiten a los atacantes realizar acciones no autorizadas mediante la creación de peticiones maliciosas a puntos finales como /database/, /command/ y /document/. Los atacantes pueden crear o eliminar bases de datos, modificar clases de esquema, gestionar usuarios y crear funciones enviando peticiones autenticadas sin validación de token, combinado con vulnerabilidades de cross-site scripting reflejado y almacenado en la interfaz web.

24 Feb 2026, 16:42

Type Values Removed Values Added
First Time Orientdb
Orientdb orientdb
References () https://orientdb.dev/ - () https://orientdb.dev/ - Product
References () https://www.exploit-db.com/exploits/46517 - () https://www.exploit-db.com/exploits/46517 - Exploit, VDB Entry
References () https://www.vulncheck.com/advisories/orientdb-cross-site-request-forgery - () https://www.vulncheck.com/advisories/orientdb-cross-site-request-forgery - Third Party Advisory
CPE cpe:2.3:a:orientdb:orientdb:3.0.17:*:*:*:*:*:*:*

20 Feb 2026, 23:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-20 23:16

Updated : 2026-06-17 02:32

NVD link : CVE-2019-25447

Mitre link : CVE-2019-25447

CVE.ORG link : CVE-2019-25447

JSON object : View

Products Affected

orientdb

  • orientdb
CWE
CWE-352

Cross-Site Request Forgery (CSRF)