Published: 10/01/2018 Updated: 03/10/2019

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Redmine prior to 3.2.9, 3.3.x prior to 3.3.6, and 3.4.x prior to 3.4.4 does not block the --config and --debugger flags to the Mercurial hg program, which allows remote malicious users to execute arbitrary commands (through the Mercurial adapter) via vectors involving a branch whose name begins with a --config= or --debugger= substring, a related issue to CVE-2017-17536.

Vulnerable Product	Search on Vulmon	Subscribe to Product
redmine redmine
debian debian linux 9.0

Multiple vulnerabilities were discovered in Redmine, a project management web application They could lead to remote code execution, information disclosure or cross-site scripting attacks For the stable distribution (stretch), these problems have been fixed in version 331-4+deb9u1 We recommend that you upgrade your redmine packages In addition ...

Debian Bug report logs - #882545 redmine: CVE-2017-15569 Package: src:redmine; Maintainer for src:redmine is Debian Ruby Extras Maintainers <pkg-ruby-extras-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 23 Nov 2017 20:51:02 UTC Severity: important Tags: patch, ...

Debian Bug report logs - #882547 redmine: CVE-2017-15570 Package: src:redmine; Maintainer for src:redmine is Debian Ruby Extras Maintainers <pkg-ruby-extras-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 23 Nov 2017 20:51:08 UTC Severity: important Tags: patch, ...

Debian Bug report logs - #887307 redmine: CVE-2017-18026 Package: src:redmine; Maintainer for src:redmine is Debian Ruby Extras Maintainers <pkg-ruby-extras-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sun, 14 Jan 2018 19:54:02 UTC Severity: important Tags: securit ...

Debian Bug report logs - #882548 redmine: CVE-2017-15571 Package: src:redmine; Maintainer for src:redmine is Debian Ruby Extras Maintainers <pkg-ruby-extras-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 23 Nov 2017 20:51:20 UTC Severity: important Tags: patch, ...

Debian Bug report logs - #882544 redmine: CVE-2017-15568 Package: src:redmine; Maintainer for src:redmine is Debian Ruby Extras Maintainers <pkg-ruby-extras-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 23 Nov 2017 20:48:02 UTC Severity: important Tags: patch, ...

NVD-CWE-noinfo https://www.redmine.org/projects/redmine/wiki/Security_Advisories https://www.redmine.org/issues/27516 https://github.com/redmine/redmine/commit/ca87bf766cdc70179cb2dce03015d78ec9c13ebd https://github.com/redmine/redmine/commit/9d797400eaec5f9fa7ba9507c82d9c18cb91d02e https://github.com/redmine/redmine/commit/58ed8655136ff2fe5ff7796859bf6a399c76c678 https://www.debian.org/security/2018/dsa-4191 https://nvd.nist.gov https://www.debian.org/security/./dsa-4191

CVE-2017-18026

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect