CVE-2017-11467: OrientDB Core - Improper Privilege Management leading to arbitrary command injection
Summary
CVE-2017-11467: OrientDB vulnerable to Improper Privilage Management leading to arbitrary command injection. Affects com.orientechnologies:orientdb-core versions < 2.2.23. Fixed in 2.2.23. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OrientDB is an open-source NoSQL database management system written in Java. It provides support for graph, document, key-value, and object-oriented models. OrientDB allows users to execute queries using a SQL-like language. The OrientDB Core package, specifically versions up to 2.2.22, is vulnerable to an improper privilege management issue.
Vulnerability Detail
The vulnerability in OrientDB Core (up to version 2.2.22) arises from the lack of enforcement of privilege requirements during the use of certain query components such as "where", "fetchplan", or "order by". This flaw enables remote attackers to execute arbitrary operating system commands by crafting a malicious request. The impact of this vulnerability can be severe, as it allows unauthorized command execution on the affected system.
How To Fix
Latest published version: 3.2.57 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.2.23
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement input validation and sanitization on the server-side to prevent the execution of arbitrary commands. Additionally, network-level access controls and firewalls can be employed to limit access to the OrientDB server, reducing the attack surface.
Conclusion
The vulnerability in OrientDB Core (CVE-2017-11467) allows remote attackers to execute arbitrary commands on the affected system. To mitigate this risk, it is crucial to upgrade to OrientDB Core version 2.2.23 or later. Implementing input validation and network-level access controls can provide temporary protection. For further assistance with vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for com.orientechnologies:orientdb-core →
FAQ
OrientDB is an open-source NoSQL database management system that supports various data models.
Versions up to 2.2.22 of OrientDB Core are vulnerable to this issue.
An attacker can exploit this vulnerability by crafting a malicious request that includes arbitrary operating system commands.
The impact of this vulnerability is severe, as it allows remote attackers to execute arbitrary commands on the affected system.
Yes, upgrading to OrientDB Core version 2.2.23 or later fixes this vulnerability.
