CVE-2015-2203

Published: Feb 1, 2018Modified: Nov 21, 2024

6.5

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Evergreen 2.5.9, 2.6.7, and 2.7.4 allows remote authenticated users with STAFF_LOGIN permission to obtain sensitive settings history information by leveraging listing of open-ils.pcrud as a controller in the IDL.

Affected (3)

Products: Evergreen Ils: Evergreen

Evergreen Ils

1 product

Evergreen

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Evergreen Ils Evergreen	Version 2.5.9
Evergreen Ils Evergreen	Version 2.6.7
Evergreen Ils Evergreen	Version 2.7.4

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (16)

http://evergreen-ils.org/downloads/ChangeLog-2.5.8-2.5.9

Source: cve@mitre.org

Issue TrackingRelease Notes

http://evergreen-ils.org/downloads/ChangeLog-2.6.6-2.6.7

Source: cve@mitre.org

Issue TrackingRelease Notes

http://evergreen-ils.org/downloads/ChangeLog-2.7.3-2.7.4

Source: cve@mitre.org

Issue TrackingRelease Notes

http://evergreen-ils.org/security-releases-evergreen-2-7-4-2-6-7-and-2-5-9/

Source: cve@mitre.org

Release Notes

http://git.evergreen-ils.org/?p=Evergreen.git%3Ba=commit%3Bh=ac588e879cf73ff1b65617e0bd273361d3529063

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2015/03/04/3

Source: cve@mitre.org

Mailing ListThird Party Advisory

http://www.securityfocus.com/bid/72885

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://bugs.launchpad.net/evergreen/+bug/1206589

Source: cve@mitre.org

Issue TrackingPatch

http://evergreen-ils.org/downloads/ChangeLog-2.5.8-2.5.9