CVE-2015-2913: Vulnerability in com.orientechnologies:orientdb-studio
Summary
CVE-2015-2913: OrientDB Server Community Edition uses insufficiently random values to generate session IDs. Affects com.orientechnologies:orientdb-server across 2 version ranges.
< 2.0.15
>= 2.1.0, < 2.1.1
Fixed in 2.0.15 or 2.1.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
com.orientechnologies:orientdb-studio is a component of OrientDB Server Community Edition. It provides a Studio interface for managing and interacting with the OrientDB database. The vulnerability in this package affects versions before 2.0.15 and 2.1.x before 2.1.1. The vulnerability is related to the generation of random Session ID values in the Studio component, which relies on the java.util.Random class. This reliance on a predictable PRNG (Pseudo-Random Number Generator) makes it easier for remote attackers to predict the Session ID value by determining the internal state of the PRNG.
Vulnerability Detail
The vulnerability in com.orientechnologies:orientdb-studio allows remote attackers to predict Session ID values, which can have various ramifications. By predicting the Session ID, an attacker can potentially hijack user sessions, gain unauthorized access to sensitive information, or perform other malicious activities. The vulnerability is considered moderate in severity with a CVSS score of 5.9.
How To Fix
Latest published version: 3.2.57 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.0.152.0.15 -
>= 2.1.0, < 2.1.12.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the fixed versions as mentioned in the 'how_to_fix' section.
Conclusion
The vulnerability in com.orientechnologies:orientdb-studio allows remote attackers to predict Session ID values, potentially leading to unauthorized access and other malicious activities. It is recommended to upgrade to the fixed versions to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for com.orientechnologies:orientdb-server →
FAQ
The vulnerability allows remote attackers to predict Session ID values, potentially leading to session hijacking, unauthorized access, and other malicious activities.
Versions before 2.0.15 and 2.1.x before 2.1.1 of com.orientechnologies:orientdb-studio are affected.
No specific workaround is mentioned. Upgrading to the fixed versions is recommended.
The vulnerability is considered moderate in severity with a CVSS score of 5.9.
You can find more information about this vulnerability in the provided source link.
