CVEvulnerability
CVE-2015-2204
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2018-02-01
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to bypass an intended access restriction and obtain sensitive information about org unit settings by leveraging failure of open-ils.actor.ou_setting.ancestor_default to enforce view_perm when no auth token is provided.
Affected configurations
• evergreen-ils evergreen (< 2.5.9)
• evergreen-ils evergreen (>= 2.6.0 < 2.6.7)
• evergreen-ils evergreen (>= 2.7.0 < 2.7.4)
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://evergreen-ils.org/downloads/ChangeLog-2.5.8-2.5.9 Issue Tracking, Release Notes
- http://evergreen-ils.org/downloads/ChangeLog-2.6.6-2.6.7 Issue Tracking, Release Notes
- http://evergreen-ils.org/downloads/ChangeLog-2.7.3-2.7.4 Issue Tracking, Release Notes
- http://evergreen-ils.org/security-releases-evergreen-2-7-4-2-6-7-and-2-5-9/ Issue Tracking, Patch, Release Notes
- http://git.evergreen-ils.org/?p=Evergreen.git%3Ba=commit%3Bh=3a0f1cc7b2efa517ee4cd4c6a682237554fed307 git.evergreen-ils.org
- http://www.openwall.com/lists/oss-security/2015/03/04/3 Issue Tracking, Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/72889 Third Party Advisory, VDB Entry
- https://bugs.launchpad.net/evergreen/+bug/1424755 Issue Tracking, Patch, Vendor Advisory
- http://evergreen-ils.org/downloads/ChangeLog-2.5.8-2.5.9 Issue Tracking, Release Notes
- http://evergreen-ils.org/downloads/ChangeLog-2.6.6-2.6.7 Issue Tracking, Release Notes
- http://evergreen-ils.org/downloads/ChangeLog-2.7.3-2.7.4 Issue Tracking, Release Notes
- http://evergreen-ils.org/security-releases-evergreen-2-7-4-2-6-7-and-2-5-9/ Issue Tracking, Patch, Release Notes
- http://git.evergreen-ils.org/?p=Evergreen.git%3Ba=commit%3Bh=3a0f1cc7b2efa517ee4cd4c6a682237554fed307 git.evergreen-ils.org
- http://www.openwall.com/lists/oss-security/2015/03/04/3 Issue Tracking, Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/72889 Third Party Advisory, VDB Entry
- https://bugs.launchpad.net/evergreen/+bug/1424755 Issue Tracking, Patch, Vendor Advisory