Description
OrientDB 3.0.17 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted JSON payloads to the document endpoint. Attackers can send POST requests to /document/demodb/-1:-1 with script tags in the name parameter to execute arbitrary JavaScript in users' browsers.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Orientdb | OrientDB | 3.0.17 | — |
References
- ExploitDB-46517 exploit
- OrientDB Official Website product
- VulnCheck Advisory: OrientDB 3.0.17 Reflected Cross-Site Scripting via document endpoint third-party-advisory