{"action":"Upgrade rhodecode to 2.2.7 or later.","affected":[{"fixed":"2.2.7","introduced":"0"}],"component":"rhodecode","cve_ids":["CVE-2015-1613"],"ecosystem":"PyPI","epss":0.01332,"exploited":false,"fixed_versions":["2.2.7"],"id":"tcs_01M5KG6P9PAZ29HSTBWWBBSK9P","modified_at":"2023-11-08T03:57:50.200844Z","published_at":"2015-02-16T15:59:00Z","references":["https://osv.dev/vulnerability/PYSEC-2015-33","https://rhodecode.com/blog/rhodecode-enterprise-security-release/"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2015-33","url":"https://osv.dev/vulnerability/PYSEC-2015-33"}],"summary":"RhodeCode before 2.2.7 allows remote authenticated users to obtain API keys and other sensitive information via the (1) update_repo, (2) get_locks, or (3) get_user_groups API method."}