PatchTheCVEevergreen-ils vulnerabilities
Recent CVEs affecting evergreen-ils products. 3 tracked.
evergreen-ils has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2018-02-01. Highest priority: CVE-2015-2204 (score 53/100).
- CVE-2015-2204 HIGH 7.5 UPGRADE Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to bypass an intend
- CVE-2015-2203 MEDIUM 6.5 DOWNGRADE Evergreen 2.5.9, 2.6.7, and 2.7.4 allows remote authenticated users with STAFF_LOGIN permission to obtain sens
- CVE-2013-7435 MEDIUM 6.5 UPGRADE The open-ils.pcrud endpoint in Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remot
FAQ
How do I fix evergreen-ils vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is evergreen-ils being exploited right now?
None of the tracked evergreen-ils CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which evergreen-ils CVE should I patch first?
CVE-2015-2204 currently ranks highest (53/100): Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to bypass an intend.