VulnerabilityModified
CVE-2015-2918
The Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict use of FRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
MEDIUM 6.1EPSS 0.74%
Does this matter?
Lower severity and a low EPSS score (0.74%). Track it; it rarely justifies an emergency change on its own.
Description
The Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict use of FRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
- CVSS 3.0
- 6.1 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.74% probability · 53th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- orientdb/orientdb
- Source
- cret@cert.org
References
- https://www.kb.cert.org/vuls/id/845332Third Party Advisory, US Government Resource
- https://www.kb.cert.org/vuls/id/845332Third Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.