PT-2016-3906 · Redmine · Redmine

Yassine Aboukir · Published 2016-03-23 · Updated 2016-04-20 · CVE-2015-8474

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Redmine versions prior to 2.6.7 Redmine versions 3.0.x prior to 3.0.5 Redmine versions 3.1.x prior to 3.1.1

Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted back url parameter. This can be achieved by manipulating the back url parameter in the valid back url function.

Recommendations For versions prior to 2.6.7, update to version 2.6.7 or later. For versions 3.0.x prior to 3.0.5, update to version 3.0.5 or later. For versions 3.1.x prior to 3.1.1, update to version 3.1.1 or later.

Fix

Related Identifiers

CVE-2015-8474

DSA-3529-1

Affected Products

Redmine

References · 23

• https://security-tracker.debian.org/tracker/CVE-2015-8474 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-3529-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8473 · Security Note
• https://cve.org/CVERecord?id=CVE-2015-8474 · Security Note
• https://osv.dev/vulnerability/CVE-2015-8474 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-8474 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8346 · Security Note
• https://redmine.org/issues/19577 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-8474 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8474 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-8474 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/redmine · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3529-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-8474 · Security Note
• http://redmine.org/news/101 · Patch