VULNERABILITY INTELLIGENCE
CVE-2015-2204
CVSS score7.5 HIGH
EPSS probability3.11%
CISA KEVNot currently listed
Published2018-02-01
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to bypass an intended access restriction and obtain sensitive information about org unit settings by leveraging failure of open-ils.actor.ou_setting.ancestor_default to enforce view_perm when no auth token is provided.
Weakness classification
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Primary references
- cve@mitre.org — Issue Tracking, Release Notes
- cve@mitre.org — Issue Tracking, Release Notes
- cve@mitre.org — Issue Tracking, Release Notes
- cve@mitre.org — Issue Tracking, Patch, Release Notes
- cve@mitre.org
- cve@mitre.org — Issue Tracking, Mailing List, Third Party Advisory
- cve@mitre.org — Third Party Advisory, VDB Entry
- cve@mitre.org — Issue Tracking, Patch, Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Release Notes
- af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Release Notes
- af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Release Notes
- af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Patch, Release Notes