Published: 12/04/2016 Updated: 20/04/2016

CVSS v2 Base Score: 4 | Impact Score: 2.9 | Exploitability Score: 8

CVSS v3 Base Score: 4.3 | Impact Score: 1.4 | Exploitability Score: 2.8

VMScore: 356

Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N

The Issues API in Redmine prior to 2.6.8, 3.0.x prior to 3.0.6, and 3.1.x prior to 3.1.2 allows remote authenticated users to obtain sensitive information in changeset messages by leveraging permission to read issues with related changesets from other projects.

Vulnerable Product	Search on Vulmon	Subscribe to Product
debian debian linux 8.0
redmine redmine 3.1.0
redmine redmine 3.1.1
redmine redmine 3.0.4
redmine redmine 3.0.2
redmine redmine 3.0.0
redmine redmine 3.0.1
redmine redmine
redmine redmine 3.0.5
redmine redmine 3.0.3

Debian Bug report logs - #807272 redmine: CVE-2015-8474: open redirect vulnerability Package: src:redmine; Maintainer for src:redmine is Debian Ruby Extras Maintainers <pkg-ruby-extras-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sun, 6 Dec 2015 21:39:02 UTC Sever ...

Debian Bug report logs - #807826 redmine: CVE-2015-8537: Data disclosure in atom feed Package: src:redmine; Maintainer for src:redmine is Debian Ruby Extras Maintainers <pkg-ruby-extras-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sun, 13 Dec 2015 15:06:02 UTC Seve ...

Debian Bug report logs - #807345 redmine: CVE-2015-8473: Issues API may disclose changeset messages that are not visible Package: src:redmine; Maintainer for src:redmine is Debian Ruby Extras Maintainers <pkg-ruby-extras-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: ...

Debian Bug report logs - #806376 redmine: CVE-2015-8346: Data disclosure on the time logging form Package: src:redmine; Maintainer for src:redmine is Debian Ruby Extras Maintainers <pkg-ruby-extras-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 26 Nov 2015 19:09: ...

CWE-200 https://www.redmine.org/issues/21136 https://www.redmine.org/projects/redmine/wiki/Changelog_3_1 https://github.com/redmine/redmine/commit/8d8f612fa368a72c56b63f7ce6b7e98cab9feb22 https://www.redmine.org/projects/redmine/wiki/Changelog_3_0 http://www.debian.org/security/2016/dsa-3529 http://www.securityfocus.com/bid/78621 https://www.redmine.org/versions/105 https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=807272

CVE-2015-8473

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect