Evergreen 2.5.9, 2.6.7, and 2.7.4 allows remote authenticated users with STAFF_LOGIN…
Priority LOW 33CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-200.
Summary
Evergreen 2.5.9, 2.6.7, and 2.7.4 allows remote authenticated users with STAFF_LOGIN permission to obtain sensitive settings history information by leveraging listing of open-ils.pcrud as a controller in the IDL.
Why it matters now
EPSS 0.02167 82nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:evergreen-ils:evergreen:2.5.9:*:*:*:*:*:*:* | 2.5.9 | Vulnerable | Evergreen-ils |
| cpe:2.3:a:evergreen-ils:evergreen:2.6.7:*:*:*:*:*:*:* | 2.6.7 | Vulnerable | Evergreen-ils |
| cpe:2.3:a:evergreen-ils:evergreen:2.7.4:*:*:*:*:*:*:* | 2.7.4 | Vulnerable | Evergreen-ils |
- cpe:2.3:a:evergreen-ils:evergreen:2.5.9:*:*:*:*:*:*:* Versions 2.5.9 Vulnerable ·Evergreen-ils
- cpe:2.3:a:evergreen-ils:evergreen:2.6.7:*:*:*:*:*:*:* Versions 2.6.7 Vulnerable ·Evergreen-ils
- cpe:2.3:a:evergreen-ils:evergreen:2.7.4:*:*:*:*:*:*:* Versions 2.7.4 Vulnerable ·Evergreen-ils
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2015-2203
- 2026-10-03 Alias added: GHSA-c97p-7qc3-rpcv
References
Other 5
- http://evergreen-ils.org/downloads/ChangeLog-2.7.3-2.7.4
- http://git.evergreen-ils.org/?p=Evergreen.git%3Ba=commit%3Bh=ac588e879cf73ff1b65617e0bd273361d3529063
- http://evergreen-ils.org/downloads/ChangeLog-2.6.6-2.6.7
- http://evergreen-ils.org/downloads/ChangeLog-2.5.8-2.5.9
- http://evergreen-ils.org/security-releases-evergreen-2-7-4-2-6-7-and-2-5-9/
More Evergreen-ils Evergreen vulnerabilities
- TI-2015-01965 Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote… CVSS 3.0HIGH 7.5
- TI-2013-06087 The open-ils.pcrud endpoint in Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x… CVSS 3.0MEDIUM 6.5
Sources
- CVE-2015-2203 · CVE Program
- CVE-2015-2203 · NVD
- FIRST EPSS
- GHSA-c97p-7qc3-rpcv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences