CVE-2013-7435

Severity: medium (CVSS 6.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-02-01 · updated 2026-06-17
Weakness: CWE-200

Description

The open-ils.pcrud endpoint in Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to obtain sensitive settings history information by leveraging lack of user permission for retrieval in fm_IDL.xml.

Affected products

Evergreen-Ils Evergreen: before 2.5.9; from 2.6.0 before 2.6.7; from 2.7.0 before 2.7.4 — fixed in 2.5.9, 2.6.7, 2.7.4

How to fix

Upgrade to a fixed version: Evergreen-Ils Evergreen 2.5.9, 2.6.7, 2.7.4. Check the vendor advisory for mitigations.

References

http://evergreen-ils.org/downloads/ChangeLog-2.5.8-2.5.9
http://evergreen-ils.org/downloads/ChangeLog-2.6.6-2.6.7
http://evergreen-ils.org/downloads/ChangeLog-2.7.3-2.7.4
http://evergreen-ils.org/security-releases-evergreen-2-7-4-2-6-7-and-2-5-9/
http://git.evergreen-ils.org/?p=Evergreen.git%3Ba=commit%3Bh=ac588e879cf73ff1b65617e0bd273361d3529063
http://www.openwall.com/lists/oss-security/2015/03/04/3
https://bugs.launchpad.net/evergreen/+bug/1206589
http://evergreen-ils.org/downloads/ChangeLog-2.5.8-2.5.9
http://evergreen-ils.org/downloads/ChangeLog-2.6.6-2.6.7
http://evergreen-ils.org/downloads/ChangeLog-2.7.3-2.7.4
http://evergreen-ils.org/security-releases-evergreen-2-7-4-2-6-7-and-2-5-9/
http://git.evergreen-ils.org/?p=Evergreen.git%3Ba=commit%3Bh=ac588e879cf73ff1b65617e0bd273361d3529063

Get alerted when CVE-2013-7435 or the next vulnerability affects your stack