PT-2021-4565 · Redmine · Redmine

Niubl · Published 2021-04-16 · Updated 2024-03-06 · CVE-2021-31865

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Redmine versions prior to 4.0.9 Redmine versions 4.1.x prior to 4.1.3 Redmine versions 4.2.x prior to 4.2.1

Description The issue is related to the circumvention of allowed filename extensions for uploaded attachments, potentially allowing a remote attacker to impact data integrity.

Recommendations For Redmine versions prior to 4.0.9, update to version 4.0.9 or later. For Redmine versions 4.1.x prior to 4.1.3, update to version 4.1.3 or later. For Redmine versions 4.2.x prior to 4.2.1, update to version 4.2.1 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2021-05235

BIT-REDMINE-2021-31865

CVE-2021-31865

DLA-2658-1

Affected Products

Redmine

References · 18

• https://bdu.fstec.ru/vul/2021-05235 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-31865 · Security Note
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20230315SE81 · Vendor Advisory
• https://redmine.org/projects/redmine/wiki/Security_Advisories · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-31865 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-31865 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2658-1 · Vendor Advisory
• https://redmine.org/news/131 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20211008SE16 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-31865 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-redmine-2021-31865 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-31865 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-31865 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-31865 · Security Note
• https://strelets.net/patchi-i-obnovleniya-bezopasnosti#16012023 · Note