CVE-2017-15575
HighSummary
In Redmine before 3.2.6 and 3.3.x before 3.3.3, there is a lack of a check for whether the Repository module is enabled in a project's settings. This may allow remote attackers to obtain sensitive differences information or possibly have unspecified other impact.
Risk Assessment
The lack of proper safeguards may lead to the exposure of sensitive data, posing a risk to the security of projects in Redmine.
Recommendation
It is recommended to update Redmine to the latest version and verify the settings of the Repository module in projects.
Other vulnerabilities in Redmine
See all- CVE-2017-15577High
Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles the rendering of wiki links, which allows remote attackers to obtain sensitive information.
- CVE-2017-15576High
Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles Time Entry rendering in activity views, which allows remote attackers to obtain sensitive information.
- CVE-2017-15572High
In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information (password reset tokens) by reading a Referer log, because account/lost_password does not use a redirect.
Original NVD description (English source)
In Redmine before 3.2.6 and 3.3.x before 3.3.3, Redmine.pm lacks a check for whether the Repository module is enabled in a project's settings, which might allow remote attackers to obtain sensitive differences information or possibly have unspecified other impact.