CVE-2015-0260: Sensitive Information Disclosure in RhodeCode and Kallithea
Summary
CVE-2015-0260: RhodeCode and Kallithea are vulnerable to sensitive information disclosure. Affects rhodecode versions < 2.2.7. Fixed in 2.2.7. How to fix ↓
Also tracked for
- kallithea · PyPI
The same CVE-2015-0260 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
RhodeCode and Kallithea are open-source software packages used for version control and code collaboration. RhodeCode versions prior to 2.2.7 and Kallithea version 0.1 are affected by a vulnerability that allows remote authenticated users to obtain API keys and other sensitive information. This vulnerability can potentially lead to unauthorized access and misuse of sensitive data.
Vulnerability Detail
The vulnerability in RhodeCode and Kallithea arises from a flaw in the get_repo API method. Remote authenticated users can exploit this vulnerability to retrieve API keys and other sensitive information. This can result in unauthorized access to repositories and potential data breaches. The vulnerability has a moderate severity rating (CWE-200).
How To Fix
Minimum fixed version
2.2.7
This is the first release that contains the fix.
pip install --upgrade "rhodecode==2.2.7"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to update to the latest patched versions of RhodeCode and Kallithea.
Conclusion
RhodeCode and Kallithea versions prior to the specified fixed versions are vulnerable to sensitive information disclosure. It is crucial to update to the latest patched versions to protect against potential unauthorized access and data breaches. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for rhodecode →
FAQ
The vulnerability allows remote authenticated users to obtain API keys and sensitive information, potentially leading to unauthorized access and data breaches.
No, only versions prior to 2.2.7 for RhodeCode and version 0.1 for Kallithea are affected.
Exploiting this vulnerability requires remote authenticated access, making it less likely to be exploited by external attackers.
There is no evidence of active exploits targeting this vulnerability at the moment.
Implementing proper access controls and user permissions can help mitigate the risk associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for rhodecode.
