PT-2021-4575 · Redmine · Redmine

Niubl · Published 2021-04-23 · Updated 2024-03-06 · CVE-2021-31863

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Redmine versions prior to 4.0.9 Redmine versions 4.1.x prior to 4.1.3 Redmine versions 4.2.x prior to 4.2.1

Description The issue is related to insufficient input validation in the Git repository integration of Redmine, allowing remote attackers to access confidential data. This can enable Redmine users to read arbitrary local files that are accessible by the application server process.

Recommendations For Redmine versions prior to 4.0.9, update to version 4.0.9 or later. For Redmine versions 4.1.x prior to 4.1.3, update to version 4.1.3 or later. For Redmine versions 4.2.x prior to 4.2.1, update to version 4.2.1 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2021-05246

BIT-REDMINE-2021-31863

CVE-2021-31863

DLA-2658-1

Affected Products

Redmine

References · 19

• https://security-tracker.debian.org/tracker/CVE-2021-31863 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-31863 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20230315SE81 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31863 · Security Note
• https://ubuntu.com/security/CVE-2021-31863 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-31863 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-redmine-2021-31863 · Vendor Advisory
• https://redmine.org/projects/redmine/wiki/Security_Advisories · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05246 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-31863 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2658-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20211008SE16 · Vendor Advisory
• https://redmine.org/news/131 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-31863 · Security Note
• https://t.me/cvenotify/14357 · Telegram Post