CVE-2017-11467: OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by"...

Security readout for executives and security teams

OrientDB versions through 2.2.22 may let a remote attacker bypass privilege checks in query features and run OS commands. The business risk is unauthorized control of a database host if an affected OrientDB service is reachable. The bundle does not provide CVSS, CWE, or confirmed active exploitation evidence. Organizations are exposed if they run OrientDB 2.2.22 or earlier, especially where OrientDB endpoints are reachable from untrusted networks. The provided affected-product metadata is incomplete, so confirm product and version directly from asset inventory and service owners. Treat this as high priority for any exposed or business-critical OrientDB deployment. Remote command execution against a database host can become a server compromise. If no OrientDB is present, risk is not applicable but should still be closed through inventory evidence. Mitigation focus: Identify all OrientDB deployments and record exact versions.; Prioritize upgrade review for OrientDB through 2.2.22.; Check OrientDB 2.2.23 release notes and vendor guidance for the fixed version..

Prepared

Jun 13, 2026, 04:25 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.