CVE-2013-7435: The open-ils.pcrud endpoint in Evergreen before 2.5.9, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows re...

Security readout for executives and security teams

CVE-2013-7435 is an information disclosure flaw in Evergreen. Older Evergreen versions could let a remote attacker read sensitive settings history through the open-ils.pcrud endpoint because permission checks were missing for retrieval. Exposure is most likely in organizations still running the named older Evergreen ILS branches. The source bundle does not identify other affected products, CPEs, or deployment-specific exposure conditions. Treat this as a targeted data-exposure issue for Evergreen environments. Prioritize remediation if Evergreen is internet-reachable, handles sensitive configuration, or runs an affected legacy version. Mitigation focus: Upgrade Evergreen to 2.5.9, 2.6.7, 2.7.4, or a later supported release.; Review the Evergreen security release notes and changelogs for operational guidance.; Confirm no unsupported Evergreen branches remain in production..

Prepared

Jun 7, 2026, 20:58 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.