CVE-2017-15576
HighSummary
Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles Time Entry rendering in activity views, which allows remote attackers to obtain sensitive information.
Risk Assessment
Attackers may gain access to sensitive data, potentially compromising user privacy and organizational security.
Recommendation
It is recommended to update Redmine to the latest version to mitigate this vulnerability.
Other vulnerabilities in Redmine
See all- CVE-2017-15577High
Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles the rendering of wiki links, which allows remote attackers to obtain sensitive information.
- CVE-2017-15575High
In Redmine before 3.2.6 and 3.3.x before 3.3.3, there is a lack of a check for whether the Repository module is enabled in a project's settings. This may allow remote attackers to obtain sensitive differences information or possibly have unspecified other impact.
- CVE-2017-15572High
In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information (password reset tokens) by reading a Referer log, because account/lost_password does not use a redirect.
Original NVD description (English source)
Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles Time Entry rendering in activity views, which allows remote attackers to obtain sensitive information.