CVE-2015-2203

Evergreen 2.5.9, 2.6.7, and 2.7.4 allows remote authenticated users with STAFF_LOGIN permission to obtain sensitive settings history information by leveraging listing of open-ils.pcrud as a controller in the IDL.

• CWE-200

• http://evergreen-ils.org/downloads/ChangeLog-2.5.8-2.5.9Issue Tracking, Release Notes
• http://evergreen-ils.org/downloads/ChangeLog-2.6.6-2.6.7Issue Tracking, Release Notes
• http://evergreen-ils.org/downloads/ChangeLog-2.7.3-2.7.4Issue Tracking, Release Notes
• http://evergreen-ils.org/security-releases-evergreen-2-7-4-2-6-7-and-2-5-9/Release Notes
• http://git.evergreen-ils.org/?p=Evergreen.git%3Ba=commit%3Bh=ac588e879cf73ff1b65617e0bd273361d3529063
• http://www.openwall.com/lists/oss-security/2015/03/04/3Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/72885Third Party Advisory, VDB Entry
• https://bugs.launchpad.net/evergreen/+bug/1206589Issue Tracking, Patch
• http://evergreen-ils.org/downloads/ChangeLog-2.5.8-2.5.9Issue Tracking, Release Notes
• http://evergreen-ils.org/downloads/ChangeLog-2.6.6-2.6.7Issue Tracking, Release Notes
• http://evergreen-ils.org/downloads/ChangeLog-2.7.3-2.7.4Issue Tracking, Release Notes
• http://evergreen-ils.org/security-releases-evergreen-2-7-4-2-6-7-and-2-5-9/Release Notes
• http://git.evergreen-ils.org/?p=Evergreen.git%3Ba=commit%3Bh=ac588e879cf73ff1b65617e0bd273361d3529063
• http://www.openwall.com/lists/oss-security/2015/03/04/3Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/72885Third Party Advisory, VDB Entry
• https://bugs.launchpad.net/evergreen/+bug/1206589Issue Tracking, Patch

Published

Feb 1, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-2196SQL injection vulnerability in Spider Event Calendar 1.4.9 f…
• CVE-2015-2197Cross-site scripting (XSS) vulnerability in the Entity API m…
• CVE-2015-2198Multiple cross-site scripting (XSS) vulnerabilities in edit_…
• CVE-2015-2199Multiple SQL injection vulnerabilities in the WonderPlugin A…
• CVE-2015-2201Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows Vi…7.2
• CVE-2015-2202Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows ad…7.2
• CVE-2015-2204Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before…
• CVE-2015-2206libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0…
• CVE-2015-2207Multiple cross-site scripting (XSS) vulnerabilities in NetCr…5.4
• CVE-2015-2208The saveObject function in moadmin.php in phpMoAdmin 1.1.2 a…
• CVE-2015-2209DLGuard 4.5 allows remote attackers to obtain the installati…
• CVE-2015-2210The help window in Epicor CRS Retail Store before 3.2.03.01.…