PT-2021-4569 · Redmine · Redmine

Niubl · Published 2021-04-25 · Updated 2024-03-06 · CVE-2021-31864

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Redmine versions prior to 4.0.9 Redmine versions 4.1.x prior to 4.1.3 Redmine versions 4.2.x prior to 4.2.1

Description The issue allows attackers to bypass the add issue notes permission requirement by leveraging the incoming mail handler. This can enable a remote attacker to impact data integrity.

Recommendations For Redmine versions prior to 4.0.9, update to version 4.0.9 or later. For Redmine versions 4.1.x prior to 4.1.3, update to version 4.1.3 or later. For Redmine versions 4.2.x prior to 4.2.1, update to version 4.2.1 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2021-05240

BIT-REDMINE-2021-31864

CVE-2021-31864

DLA-2658-1

Affected Products

Redmine

References · 18

• https://cve.org/CVERecord?id=CVE-2021-31864 · Security Note
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20230315SE81 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-31864 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-31864 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05240 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-31864 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-31864 · Vendor Advisory
• https://redmine.org/projects/redmine/wiki/Security_Advisories · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-31864 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31864 · Security Note
• https://osv.dev/vulnerability/DLA-2658-1 · Vendor Advisory
• https://redmine.org/news/131 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20211008SE16 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-redmine-2021-31864 · Vendor Advisory
• https://strelets.net/patchi-i-obnovleniya-bezopasnosti#16012023 · Note