PT-2022-6947 · Redmine · Redmine
Published
2022-12-12
·
Updated
2024-03-06
·
CVE-2022-44031
CVSS v2.0
6.4
Medium
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Redmine versions prior to 4.2.9
Redmine versions 5.0.x prior to 5.0.4
Description
The issue is related to the improper sanitization of the blockquote syntax in Textile-formatted fields, which can lead to a persistent XSS attack. This allows a remote attacker to conduct an inter-site scripting attack. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.
Recommendations
For Redmine versions prior to 4.2.9, update to version 4.2.9 or later.
For Redmine versions 5.0.x prior to 5.0.4, update to version 5.0.4 or later.
As a temporary workaround, consider disabling the Textile formatter until a patch is available. Restrict access to Textile-formatted fields to minimize the risk of exploitation. Avoid using the blockquote syntax in Textile-formatted fields until the issue is resolved.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Redmine