CVE-2017-15577
HighSummary
Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles the rendering of wiki links, which allows remote attackers to obtain sensitive information.
Risk Assessment
Attackers can exploit this vulnerability to steal sensitive data, potentially leading to serious security breaches within the organization.
Recommendation
It is recommended to update Redmine to the latest version to mitigate this vulnerability.
Other vulnerabilities in Redmine
See all- CVE-2017-15576High
Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles Time Entry rendering in activity views, which allows remote attackers to obtain sensitive information.
- CVE-2017-15575High
In Redmine before 3.2.6 and 3.3.x before 3.3.3, there is a lack of a check for whether the Repository module is enabled in a project's settings. This may allow remote attackers to obtain sensitive differences information or possibly have unspecified other impact.
- CVE-2017-15572High
In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information (password reset tokens) by reading a Referer log, because account/lost_password does not use a redirect.
Original NVD description (English source)
Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles the rendering of wiki links, which allows remote attackers to obtain sensitive information.