nvd-json-data-feeds/CVE-2015/CVE-2015-29xx/CVE-2015-2918.json

{
  "id": "CVE-2015-2918",
  "sourceIdentifier": "cret@cert.org",
  "published": "2015-12-31T05:59:10.440",
  "lastModified": "2015-12-31T20:41:43.143",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "The Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict use of FRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site."
    },
    {
      "lang": "es",
      "value": "El componente Studio en OrientDB Server Community Edition en versiones anteriores a 2.0.15 y 2.1.x en versiones anteriores a 2.1.1 no restringe correctamente el uso de elementos FRAME, lo que hace m\u00e1s f\u00e1cil para atacantes remotos llevar a cabo ataques de clickjacking a trav\u00e9s de un sitio web manipulado."
    }
  ],
  "metrics": {
    "cvssMetricV30": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.0",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "accessVector": "NETWORK",
          "accessComplexity": "MEDIUM",
          "authentication": "NONE",
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "availabilityImpact": "NONE",
          "baseScore": 4.3
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:orientdb:orientdb:2.0.14:*:*:*:community:*:*:*",
              "matchCriteriaId": "6D3EEB60-F819-4F15-962C-06DDA45896E9"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:orientdb:orientdb:2.1.0:*:*:*:community:*:*:*",
              "matchCriteriaId": "C913E0D2-2E28-4BB6-957C-9832193C3FB4"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.kb.cert.org/vuls/id/845332",
      "source": "cret@cert.org",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ]
    }
  ]
}