CVE-2015-0260 RhodeCode and Kallithea are vulnerable to sensitive information disclosure
Authenticated users can retrieve API keys and sensitive data via the get_repo API method in RhodeCode and Kallithea.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-0260?
CVE-2015-0260 is a medium-severity vulnerability in n/a, published on 16 Feb 2015. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
RhodeCode before 2.2.7 and Kallithea 0.1 allows remote authenticated users to obtain API keys and other sensitive information via the get_repo API method.
Weakness: CWE-200
Which versions are affected by CVE-2015-0260?
6 open source packages ship an affected version, including kallithea, Kallithea and RhodeCode. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
kallithea PyPI | All versions | 0.2 |
kallithea PyPI | All versions | 0.2 |
Kallithea PyPI | All versions | 0.2 |
RhodeCode PyPI | All versions | 2.2.7 |
rhodecode PyPI | All versions | 2.2.7 |
rhodecode PyPI | All versions | 2.2.7 |
Products include Kallithea-Scm Kallithea, Rhodecode Rhodecode Enterprise.
How do I fix CVE-2015-0260?
Upgrade kallithea to 0.2 or later.
Is CVE-2015-0260 being exploited?
There is no known exploitation of CVE-2015-0260 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-hhx9-4vw2-x54r, PYSEC-2015-29, PYSEC-2015-32.