CVE-2015-8474 — Redmine vulnerability

4 documents4 sources
Severity
7.4HIGHNVD
OSV5.8
EPSS
0.4%
top 41.47%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
RedmineDebian RedmineDebian Linux
Timeline
PublishedApr 12
Latest updateMay 17

Description

Open redirect vulnerability in the valid_back_url function in app/controllers/application_controller.rb in Redmine before 2.6.7, 3.0.x before 3.0.5, and 3.1.x before 3.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted back_url parameter, as demonstrated by "@attacker.com," a different vulnerability than CVE-2014-1985.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:NExploitability: 2.8 | Impact: 4.0

Affected Packages3 packages

▶debiandebian/redmine< redmine 3.2.0-1 (bookworm)
▶Debianredmine/redmine< 3.2.0-1+1
▶NVDredmine/redmine2.6.6+7

Also affects: Debian Linux 7.0, 8.0

Patches

Patch: www.redmine.org ↗Patch: www.redmine.org ↗Patch: www.redmine.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-jf8c-hh25-c3q7: Open redirect vulnerability in the valid_back_url function in app/controllers/application_controller↗2022-05-17
▶
OSV
CVE-2015-8474: Open redirect vulnerability in the valid_back_url function in app/controllers/application_controller↗2016-04-12
▶

📋Vendor Advisories

1
Debian
CVE-2015-8474: redmine - Open redirect vulnerability in the valid_back_url function in app/controllers/ap...↗2015
▶