PT-2018-4364 · Equinox · Evergreen

Jason Stephenson + 1 · Published 2018-02-01 · Updated 2018-02-15 · CVE-2015-2204

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Evergreen versions prior to 2.5.9 Evergreen versions 2.6.x prior to 2.6.7 Evergreen versions 2.7.x prior to 2.7.4

Description The issue allows remote attackers to bypass an intended access restriction and obtain sensitive information about org unit settings. This is due to the failure of open-ils.actor.ou setting.ancestor default to enforce view perm when no authentication token is provided.

Recommendations For versions prior to 2.5.9, update to version 2.5.9 or later. For versions 2.6.x prior to 2.6.7, update to version 2.6.7 or later. For versions 2.7.x prior to 2.7.4, update to version 2.7.4 or later.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2015-2204

Affected Products

Evergreen

References · 9

• http://evergreen-ils.org/security-releases-evergreen-2-7-4-2-6-7-and-2-5-9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2015-2204 · Security Note
• https://bugs.launchpad.net/evergreen/+bug/1424755 · Vendor Advisory
• http://evergreen-ils.org/downloads/ChangeLog-2.5.8-2.5.9 · Note
• http://evergreen-ils.org/downloads/ChangeLog-2.6.6-2.6.7 · Note
• http://openwall.com/lists/oss-security/2015/03/04/3 · Note
• http://git.evergreen-ils.org/?p=Evergreen.git%3Ba=commit%3Bh=3a0f1cc7b2efa517ee4cd4c6a682237554fed307 · Note
• http://evergreen-ils.org/downloads/ChangeLog-2.7.3-2.7.4 · Note
• http://securityfocus.com/bid/72889 · Note