OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote attacke

Summary

OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote attackers to execute arbitrary OS commands via a crafted request.

Timeline

1. Jul 13, 2017Public exploit on Exploit-DB

   EDB-44068

2. Jul 20, 2017, 12:00 AM UTCCVE published
3. Aug 5, 2024, 6:12 PM UTCRecord last updated
4. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a n/a

  Version range not reported

• com.orientechnologies:orientdb-coreMaven

  fixed in 2.2.23

References 4