CVE-2015-2203 json
Evergreen 2.5.9, 2.6.7, and 2.7.4 allows remote authenticated users with STAFF_LOGIN permission to obtain sensitive settings history inform…
published 2018-02-01 8 y ago modified 2026-06-17 4 mo ago also EUVD-2015-2310
- cvss
- 6.5
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.2%
- EPSS 2.2% chance of exploitation in 30 days, percentile 82%
- public exploits
- 0
- none known
Summary
Evergreen 2.5.9, 2.6.7, and 2.7.4 allows remote authenticated users with STAFF_LOGIN permission to obtain sensitive settings history information by leveraging listing of open-ils.pcrud as a controller in the IDL.
Patch / fix
Exploit prediction
2.17% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 6.5 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
bugs.launchpad.net
/evergreen/+bug/1206589
issue-tracking, patch
-
evergreen-ils.org
/downloads/ChangeLog-2.7.3-2.7.4
issue-tracking, release-notes
-
openwall.com
/lists/oss-security/2015/03/04/3
mailing-list, third-party-advisory
-
securityfocus.com
/bid/72885
vdb-entry, third-party-advisory
- git.evergreen-ils.org /?p=Evergreen.git%3Ba=commit%3Bh=ac588e879cf73ff1b65617e0bd273361d3529063
-
evergreen-ils.org
/downloads/ChangeLog-2.6.6-2.6.7
issue-tracking, release-notes
-
evergreen-ils.org
/downloads/ChangeLog-2.5.8-2.5.9
issue-tracking, release-notes
-
evergreen-ils.org
/security-releases-evergreen-2-7-4-2-6-7-and-2-5-9/
release-notes
Sources
- CVE List CVE-2015-2203
- NVD CVE-2015-2203
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.