PT-2021-4607 · Redmine · Redmine

Published 2021-04-06 · Updated 2024-03-06 · CVE-2020-36308

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Redmine versions 4.0.0 through 4.0.6 Redmine versions 4.1.0 through 4.1.0

Description The issue allows attackers to discover the subject of a non-visible issue by performing a CSV export and reading time entries. It is related to insufficient neutralization of special elements in a request, which may allow a remote attacker to access confidential data.

Recommendations For Redmine versions 4.0.0 through 4.0.6, update to version 4.0.7 or later. For Redmine versions 4.1.0 through 4.1.0, update to version 4.1.1 or later.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

BDU:2021-05291

BIT-REDMINE-2020-36308

CVE-2020-36308

DLA-2658-1

Affected Products

Redmine

References · 17

• https://osv.dev/vulnerability/DEBIAN-CVE-2020-36308 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05291 · Security Note
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20230315SE81 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-36308 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-redmine-2020-36308 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-36308 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2658-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20211008SE16 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-36308 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-36308 · Security Note
• https://osv.dev/vulnerability/CVE-2020-36308 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-36308 · Vendor Advisory
• https://t.me/cvenotify/14353 · Telegram Post
• https://strelets.net/patchi-i-obnovleniya-bezopasnosti#16012023 · Note
• https://redmine.org/projects/redmine/wiki/Security_Advisories · Note