Evergreen 2.5.9, 2.6.7, and 2.7.4 allows remote authenticated users with STAFF_LOGIN permission to obtain sensitive settings history information by leveraging listing of open-ils.pcrud as a controller in the IDL.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2203
Reference (s):
- BID:72885
- URL: http://www.securityfocus.com/bid/72885
- http://evergreen-ils.org/downloads/ChangeLog-2.5.8-2.5.9
- http://evergreen-ils.org/downloads/ChangeLog-2.6.6-2.6.7
- http://evergreen-ils.org/downloads/ChangeLog-2.7.3-2.7.4