Published: 21/11/2019 Updated: 26/11/2019

CVSS v2 Base Score: 4 | Impact Score: 2.9 | Exploitability Score: 8

CVSS v3 Base Score: 6.5 | Impact Score: 3.6 | Exploitability Score: 2.8

VMScore: 357

Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N

A SQL injection vulnerability in Redmine up to and including 3.2.9 and 3.3.x prior to 3.3.10 allows Redmine users to access protected information via a crafted object query.

Vulnerable Product	Search on Vulmon	Subscribe to Product
redmine redmine
debian debian linux 9.0

Several security issues were fixed in redmine ...

Hoger Just discovered an SQL injection in Redmine, a project management web application In addition a cross-site scripting issue was found in Textile formatting For the oldstable distribution (stretch), these problems have been fixed in version 331-4+deb9u3 We recommend that you upgrade your redmine packages For the detailed security status o ...

CVE-2019-17427 Persistent XSS POC

CVE-2019-17427 CVE-2019-17427 Persistent XSS POC In Redmine before 3411 and 40x before 404, persistent XSS exists due to textile formatting errors The vulnerability essentially exists on any wiki page which by default uses textile formatting You can take advantage of it by using <pre parameter <pre onfocusin=alert("pwnd") tabindex=1 style="

CVE-2019-18890 POC (Proof of Concept)

CVE-2019-18890 CVE-2019-18890 POC (Proof of Concept) REDMINE UP TO 329/339 SQL INJECTION nvdnistgov/vuln/detail/CVE-2019-18890 Requirements: Access credentials Subproject is required REST API is enabled On Mysql the first query on which injection occurs looks like the example below with the "-SLEEP(5)" being the injected part: SELECT COUNT(*) FROM issu

CWE-89 https://www.debian.org/security/2019/dsa-4574 https://security-tracker.debian.org/tracker/CVE-2019-18890 https://www.redmine.org/projects/redmine/wiki/Security_Advisories https://usn.ubuntu.com/4200-1/https://github.com/RealLinkers/CVE-2019-18890 https://seclists.org/bugtraq/2019/Nov/31 https://usn.ubuntu.com/4200-1/https://nvd.nist.gov

CVE-2019-18890

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect