CVE-2017-11467

Critical

Published: 20/07/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

OrientDB versions up to 2.2.22 do not enforce privilege requirements during 'where', 'fetchplan', or 'order by' usage, allowing remote attackers to execute arbitrary OS commands via a crafted request.

Risk Assessment

Attackers can exploit this vulnerability to gain unauthorized access to the operating system, potentially leading to serious security breaches within the organization.

Recommendation

It is recommended to update OrientDB to the latest version to mitigate this vulnerability and implement appropriate access controls.

Original NVD description (English source)

OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote attackers to execute arbitrary OS commands via a crafted request.