Executive brief
RhodeCode before 2.2.7 and Kallithea 0.1 allows remote authenticated users to obtain API keys and other sensitive information via the get_repo API method.
Affected products
- PyPI rhodecode
- PyPI kallithea
Junglewise Threat Intelligence
CVE-2015-0260: PYSEC-2015-32 - RhodeCode before 2.2.7 and Kallithea 0.1 allows remote authenticated users to obtain API keys and other sensitive information via the get_re
CVE-2015-0260 · Severity: low · CVSS 3.1 · Published 2015-02-16
Technologies: kallithea (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-648 - Kallithea Routes CSRF Bypass
- PYSEC-2017-16 - Cross-site request forgery (CSRF) vulnerability in Kallithea before 0.2.
- PYSEC-2017-17 - Multiple cross-site scripting (XSS) vulnerabilities in the administration pages in Kallithea before 0.2.1 allow remote attackers to inject a
- PYSEC-2015-13 - CRLF injection vulnerability in Kallithea before 0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response spli
- PYSEC-2015-33 - RhodeCode before 2.2.7 allows remote authenticated users to obtain API keys and other sensitive information via the (1) update_repo, (2) get