PT-2023-9189 · Redmine · Redmine

Published 2023-11-05 · Updated 2024-05-24 · CVE-2023-47260

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Redmine versions prior to 4.2.11 Redmine versions 5.0.x prior to 5.0.6

Description The issue is related to a lack of protection for the web page structure in the Thumbnails component of the Redmine web application, allowing for cross-site scripting (XSS) attacks. This could enable a remote attacker to conduct inter-site script attacks.

Recommendations For Redmine versions prior to 4.2.11, update to version 4.2.11 or later. For Redmine versions 5.0.x prior to 5.0.6, update to version 5.0.6 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-04495

BIT-REDMINE-2023-47260

CVE-2023-47260

DSA-5699-1

Affected Products

Redmine

References · 25

• https://security-tracker.debian.org/tracker/CVE-2023-47260 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5699-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-47260 · Security Note
• https://ubuntu.com/security/CVE-2023-47260 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-47258 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-47260 · Security Note
• https://redmine.org/projects/redmine/wiki/Security_Advisories · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-47260 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-47260 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04495 · Security Note
• https://osv.dev/vulnerability/CVE-2023-47260 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/redmine · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-47259 · Security Note
• https://security-tracker.debian.org/tracker/DSA-5699-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04496 · Security Note