CVE-2015-0260
RhodeCode and Kallithea are vulnerable to sensitive information disclosure
CVE-2015-0260 is a medium vulnerability (CVSS 4.0) in Kallithea-scm Kallithea, published February 16, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.86%, the 79th percentile. Fixed in rhodecode 2.2.7.
- Severity
- 4.0 MediumCVSS 2.0, NVD
- Exploit chance
- 1.86%EPSS, 79th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.2.7rhodecode +3 more
Description
RhodeCode before 2.2.7 and Kallithea 0.1 allows remote authenticated users to obtain API keys and other sensitive information via the get_repo API method.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rhodecodePyPI | before 2.2.7 | 2.2.7 |
kallitheaPyPI | before 0.2 | 0.2 |
rhodecodePyPI | before 2.2.7, plus listed versions 1.1.01.1.11.1.21.1.31.1.4 Show 34 moreShow less1.1.51.1.61.1.71.1.81.2.01.2.11.2.21.2.31.2.41.2.51.3.01.3.11.3.21.3.31.3.41.3.51.3.61.4.01.4.11.4.21.4.31.4.41.5.01.5.11.5.21.5.31.5.41.6.01.6.0rc11.7.01.7.11.7.22.2.52.2.6 | 2.2.7 |
kallitheaPyPI | before 0.2, plus listed versions 0.00.1 | 0.2 |
What each source reports
NVD Score used
RhodeCode before 2.2.7 and Kallithea 0.1 allows remote authenticated users to obtain API keys and other sensitive information via the get_repo API method.
- Record
CVE-2015-0260- CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE ListNo score
RhodeCode before 2.2.7 and Kallithea 0.1 allows remote authenticated users to obtain API keys and other sensitive information via the get_repo API method.
- Record
CVE-2015-0260- Updated
- 2026-11-02
EUVDEUVD-2015-0027No score
RhodeCode before 2.2.7 and Kallithea 0.1 allows remote authenticated users to obtain API keys and other sensitive information via the get_repo API method.
- Record
EUVD-2015-0027- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hhx9-4vw2-x54r
RhodeCode and Kallithea are vulnerable to sensitive information disclosure
RhodeCode before 2.2.7 and Kallithea 0.1 allows remote authenticated users to obtain API keys and other sensitive information via the get_repo API method.
- Record
GHSA-hhx9-4vw2-x54r- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-hhx9-4vw2-x54r
RhodeCode and Kallithea are vulnerable to sensitive information disclosure
RhodeCode before 2.2.7 and Kallithea 0.1 allows remote authenticated users to obtain API keys and other sensitive information via the get_repo API method.
- Record
GHSA-hhx9-4vw2-x54r- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVPYSEC-2015-29No score
RhodeCode before 2.2.7 and Kallithea 0.1 allows remote authenticated users to obtain API keys and other sensitive information via the get_repo API method.
- Record
PYSEC-2015-29- Updated
- 2026-11-02
OSVPYSEC-2015-32No score
RhodeCode before 2.2.7 and Kallithea 0.1 allows remote authenticated users to obtain API keys and other sensitive information via the get_repo API method.
- Record
PYSEC-2015-32- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
kallithea-scm.org/security/cve-2015-0260.html
rhodecode.com/blog/rhodecode-enterprise-security-release
exchange.xforce.ibmcloud.com/vulnerabilities/100888
securityfocus.com/bid/72573
seclists.org/oss-sec/2015/q1/505
nvd.nist.gov/vuln/detail/CVE-2015-0260
Show 5 moreShow less
web.archive.org/web/20150321135511/http://www.securityfocus.com/bid/72573
github.com/pypa/advisory-database/tree/main/vulns/kallithea/PYSEC-2015-29.yaml