PT-2019-4747 · Redmine+1 · Redmine+1

Hoger Just · Published 2019-11-19 · Updated 2019-11-26 · CVE-2019-18890

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Redmine versions 3.2.9 and prior, 3.3.x through 3.3.9

Description A SQL injection issue allows users to access protected information via a crafted object query. The vulnerability is related to the lack of protection measures for the SQL query structure, which can be exploited by a remote attacker to gain unauthorized access to protected information.

Recommendations For Redmine versions 3.2.9 and prior, update to version 3.3.10 or later. For Redmine versions 3.3.x through 3.3.9, update to version 3.3.10 or later. As a temporary workaround, consider restricting access to sensitive data and queries until a patch is applied.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2020-01319

CVE-2019-18890

DSA-4574-1

USN-4200-1

Affected Products

Redmine

Ubuntu

References · 30

• 🔥 https://github.com/RealLinkers/CVE-2019-18890 · Exploit
• https://ubuntu.com/security/notices/USN-4200-1 · Vendor Advisory
• https://debian.org/security/2019/dsa-4574 · Vendor Advisory
• https://redmine.org/projects/redmine/wiki/Security_Advisories · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-18890 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-18890 · Security Note
• https://osv.dev/vulnerability/DSA-4574-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-18890 · Vendor Advisory
• https://usn.ubuntu.com/4200-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-18890 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20200327SE16 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-18890 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-18890 · Security Note
• https://osv.dev/vulnerability/USN-4200-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01318 · Security Note