CVE-2015-2204

Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to bypass an intended access restriction and obtain sensitive…

published February 1, 2018

CVSS
—
EPSS
3%
Percentile
87.7
In the wild
Unconfirmed
What it is

Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to bypass an intended access restriction and obtain sensitive information about org unit settings by leveraging failure of open-ils.actor.ou_setting.ancestor_default to enforce view_perm when no auth token is provided.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03110 · 87.7th percentile
Published
2018-02-01T17:00Z
EPSS history
Timeline
  • 01 FEB 17:00Z
    Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to bypass an intended access restriction and obtain sensitive…
    cvelistv5