CVE-2021-31863 — Improper Input Validation in Redmine

CWE-20 — Improper Input Validation4 documents4 sources
Severity
7.5HIGHNVD
EPSS
0.8%
top 26.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
RedmineDebian RedmineDebian Linux
Timeline
PublishedApr 28
Latest updateMay 24

Description

Insufficient input validation in the Git repository integration of Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows Redmine users to read arbitrary local files accessible by the application server process.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/redmine< redmine 5.0.0-1 (bookworm)
▶NVDredmine/redmine4.1.0 — 4.1.3+2
▶Debianredmine/redmine< 5.0.0-1+1

Also affects: Debian Linux 9.0

🔴Vulnerability Details

2
GHSA
GHSA-8hvw-4p82-cf4x: Insufficient input validation in the Git repository integration of Redmine before 4↗2022-05-24
▶
OSV
CVE-2021-31863: Insufficient input validation in the Git repository integration of Redmine before 4↗2021-04-28
▶

📋Vendor Advisories

1
Debian
CVE-2021-31863: redmine - Insufficient input validation in the Git repository integration of Redmine befor...↗2021
▶