orientechnologies/orientdb · Security
OrientDB Server Community Edition uses insufficiently random values to generate session IDs
- GHSA ID
- GHSA-v6wr-fch2-vm5w
- CVE ID
- CVE-2015-2913
- Severity
- medium
- Published
- Updated
- CVSS
- 5.9 · CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS v3
- 5.9 · CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 improperly relies on the java.util.Random class for generation of random Session ID values in the server/network/protocol/http/OHttpSessionManager.java, which makes it easier for remote attackers to predict a value by determining the internal state of the PRNG in this class.
CWEs
- CWE-330 · Use of Insufficiently Random Values