CVE-2013-7435

Published: Feb 1, 2018Modified: Nov 21, 2024

6.5

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

The open-ils.pcrud endpoint in Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to obtain sensitive settings history information by leveraging lack of user permission for retrieval in fm_IDL.xml.

Affected (3)

Products: Evergreen Ils: Evergreen

Evergreen Ils

1 product

Evergreen

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Evergreen Ils Evergreen	Before 2.5.9
Evergreen Ils Evergreen	From 2.6.0 to 2.6.7
Evergreen Ils Evergreen	From 2.7.0 to 2.7.4

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (14)

http://evergreen-ils.org/downloads/ChangeLog-2.5.8-2.5.9

Source: cve@mitre.org

Issue TrackingRelease Notes

http://evergreen-ils.org/downloads/ChangeLog-2.6.6-2.6.7

Source: cve@mitre.org

Issue TrackingRelease Notes

http://evergreen-ils.org/downloads/ChangeLog-2.7.3-2.7.4

Source: cve@mitre.org

Issue TrackingRelease Notes

http://evergreen-ils.org/security-releases-evergreen-2-7-4-2-6-7-and-2-5-9/

Source: cve@mitre.org

Issue TrackingRelease Notes

http://git.evergreen-ils.org/?p=Evergreen.git%3Ba=commit%3Bh=ac588e879cf73ff1b65617e0bd273361d3529063

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2015/03/04/3

Source: cve@mitre.org

Issue TrackingMailing ListThird Party Advisory

https://bugs.launchpad.net/evergreen/+bug/1206589

Source: cve@mitre.org

Issue TrackingPatch

http://evergreen-ils.org/downloads/ChangeLog-2.5.8-2.5.9