CVE-2015-8473
published 2016-04-12CVE-2015-8473: The Issues API in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote authenticated users to obtain sensitive information in…
PriorityP421medium4.3CVSS 3.0
AVNACLPRLUINSUCLINAN
EPSS
1.72%
74.9th percentile
The Issues API in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote authenticated users to obtain sensitive information in changeset messages by leveraging permission to read issues with related changesets from other projects.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | redmine | < redmine 3.2.0-1 (bookworm) | redmine 3.2.0-1 (bookworm) |
| redmine | redmine | <= 2.6.7 | — |
| redmine | redmine | — | — |
| redmine | redmine | — | — |
| redmine | redmine | — | — |
| redmine | redmine | — | — |
| redmine | redmine | — | — |
| redmine | redmine | — | — |
| redmine | redmine | — | — |
| redmine | redmine | — | — |
| redmine | redmine | >= 0 < 3.2.0-1 | 3.2.0-1 |
| redmine | redmine | >= 0 < 3.2.0-1 | 3.2.0-1 |
CVSS provenance
nvdv3.04.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
osv4.3MEDIUM
vendor_debian4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-4rg4-ccch-c88j: The Issues API in Redmine before 2
ghsa_unreviewed·2022-05-17
CVE-2015-8473 [MEDIUM] CWE-200 GHSA-4rg4-ccch-c88j: The Issues API in Redmine before 2
The Issues API in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote authenticated users to obtain sensitive information in changeset messages by leveraging permission to read issues with related changesets from other projects.
OSV
CVE-2015-8473: The Issues API in Redmine before 2
osv·2016-04-12·CVSS 4.3
CVE-2015-8473 [MEDIUM] CVE-2015-8473: The Issues API in Redmine before 2
The Issues API in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote authenticated users to obtain sensitive information in changeset messages by leveraging permission to read issues with related changesets from other projects.
Debian
CVE-2015-8473: redmine - The Issues API in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1...
vendor_debian·2015·CVSS 4.3
CVE-2015-8473 [MEDIUM] CVE-2015-8473: redmine - The Issues API in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1...
The Issues API in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote authenticated users to obtain sensitive information in changeset messages by leveraging permission to read issues with related changesets from other projects.
Scope: local
bookworm: resolved (fixed in 3.2.0-1)
sid: resolved (fixed in 3.2.0-1)
trixie: resolved (fixed in 3.2.0-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.debian.org/security/2016/dsa-3529http://www.securityfocus.com/bid/78621https://github.com/redmine/redmine/commit/8d8f612fa368a72c56b63f7ce6b7e98cab9feb22https://www.redmine.org/issues/21136https://www.redmine.org/projects/redmine/wiki/Changelog_3_0https://www.redmine.org/projects/redmine/wiki/Changelog_3_1https://www.redmine.org/versions/105http://www.debian.org/security/2016/dsa-3529http://www.securityfocus.com/bid/78621https://github.com/redmine/redmine/commit/8d8f612fa368a72c56b63f7ce6b7e98cab9feb22https://www.redmine.org/issues/21136https://www.redmine.org/projects/redmine/wiki/Changelog_3_0https://www.redmine.org/projects/redmine/wiki/Changelog_3_1https://www.redmine.org/versions/105
2016-04-12
Published