CVE-2015-2204

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-02-01 · updated 2026-06-17
Weakness: CWE-200

Description

Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to bypass an intended access restriction and obtain sensitive information about org unit settings by leveraging failure of open-ils.actor.ou_setting.ancestor_default to enforce view_perm when no auth token is provided.

Affected products

Evergreen-Ils Evergreen: before 2.5.9; from 2.6.0 before 2.6.7; from 2.7.0 before 2.7.4 — fixed in 2.5.9, 2.6.7, 2.7.4

How to fix

Upgrade to a fixed version: Evergreen-Ils Evergreen 2.5.9, 2.6.7, 2.7.4. Check the vendor advisory for mitigations.

References

http://evergreen-ils.org/downloads/ChangeLog-2.5.8-2.5.9
http://evergreen-ils.org/downloads/ChangeLog-2.6.6-2.6.7
http://evergreen-ils.org/downloads/ChangeLog-2.7.3-2.7.4
http://evergreen-ils.org/security-releases-evergreen-2-7-4-2-6-7-and-2-5-9/
http://git.evergreen-ils.org/?p=Evergreen.git%3Ba=commit%3Bh=3a0f1cc7b2efa517ee4cd4c6a682237554fed307
http://www.openwall.com/lists/oss-security/2015/03/04/3
http://www.securityfocus.com/bid/72889
https://bugs.launchpad.net/evergreen/+bug/1424755
http://evergreen-ils.org/downloads/ChangeLog-2.5.8-2.5.9
http://evergreen-ils.org/downloads/ChangeLog-2.6.6-2.6.7
http://evergreen-ils.org/downloads/ChangeLog-2.7.3-2.7.4
http://evergreen-ils.org/security-releases-evergreen-2-7-4-2-6-7-and-2-5-9/

Get alerted when CVE-2015-2204 or the next vulnerability affects your stack