Test ID:	1.3.6.1.4.1.25623.1.0.808754
Category:	Web application abuses
Title:	OrientDB Server < 2.0.15, 2.1.x < 2.1.1 Clickjacking Vulnerability
Summary:	OrientDB server is prone to a clickjacking vulnerability.
Description:	Summary: OrientDB server is prone to a clickjacking vulnerability. Vulnerability Insight: The flaw exists due to an OrientDB Studio web management interface does not by default enforce the same-origin policy in X-Frame-Options response headers. Vulnerability Impact: Successful exploitation will allow remote attackers to conduct clickjacking attacks.). Affected Software/OS: OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1. Solution: As a workaround use the command line argument when starting the server: Dnetwork.http.additionalResponseHeaders='X-FRAME-OPTIONS: DENY' Alternatives: - add this value to the server's orientdb-server-config.xml file - disable OrientDB Studio CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2015-2918 CERT/CC vulnerability note: VU#845332 https://www.kb.cert.org/vuls/id/845332
Copyright	Copyright (C) 2016 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.