CVE-2015-2913

server/network/protocol/http/OHttpSessionManager.java in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 improperly relies on the java.util.Random class for generation of random Session ID values, which makes it easier for remote attackers to predict a value by determining the internal state of the PRNG in this class.

• CWE-200

• https://github.com/orientechnologies/orientdb/commit/668ece96be210e742a4e2820a3085b215cf55104Vendor Advisory
• https://www.kb.cert.org/vuls/id/845332Third Party Advisory, US Government Resource
• https://github.com/orientechnologies/orientdb/commit/668ece96be210e742a4e2820a3085b215cf55104Vendor Advisory
• https://www.kb.cert.org/vuls/id/845332Third Party Advisory, US Government Resource

Published

Dec 31, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-2905Cross-site request forgery (CSRF) vulnerability on Actiontec…
• CVE-2015-2906Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x…
• CVE-2015-2907Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x…
• CVE-2015-2908Mobile Devices (aka MDI) C4 OBD-II dongles with firmware 2.x…
• CVE-2015-2909Dedicated Micros DV-IP Express, SD Advanced, SD, EcoSense, a…9.8
• CVE-2015-2912The JSONP endpoint in the Studio component in OrientDB Serve…
• CVE-2015-2914Securifi Almond devices with firmware before AL1-R201EXP10-L…
• CVE-2015-2915Securifi Almond devices with firmware before AL1-R201EXP10-L…
• CVE-2015-2916Cross-site request forgery (CSRF) vulnerability on Securifi …
• CVE-2015-2917Securifi Almond devices with firmware before AL1-R201EXP10-L…
• CVE-2015-2918The Studio component in OrientDB Server Community Edition be…
• CVE-2015-2922The ndisc_router_discovery function in net/ipv6/ndisc.c in t…