Redmine Security Report for version 3.2.3

Redmine 3.2.3 was released over 3 years ago on June 05, 2016. It is subject to 16 known vulnerabilities.

Detailed Analysis

• Information Leak

  By exploiting an information leak, an attacker may see pieces of information, which would otherwise be hidden, effectively circumventing Redmine's roles and permissions.
• SQL Injection

  Critical
  A SQL injection vulnerability allows Redmine users to access protected information via a crafted object query.
  Fixed in: 3.3.10, 3.4.0 More details: CVE-2019-18890
• Possible Information Leak / Session Hijack Vulnerability

  Moderate
  By carefully measuring the amount of time it takes to look up a session (timing attack), an attacker may be able to find a valid session id and hijack the session.
  Fixed in: 4.0.6 More details: CVE-2019-16782
• Missing permission check when access a repository via SVN

  Moderate
  Redmine.pm lacks a check for whether the Repository module is enabled in a project's settings, which might allow remote attackers to obtain sensitive differences information or possibly have unspecified other impact.
  Fixed in: 3.2.6, 3.3.3 More details: CVE-2017-15575
• Erroneous rendering of activity views

  Moderate
  Redmine mishandles Time Entry rendering in activity views, which allows remote attackers to obtain sensitive information.
  Fixed in: 3.2.6, 3.3.3 More details: CVE-2017-15576
• Erroneous rendering of wiki links

  Moderate
  Redmine mishandles the rendering of wiki links, which allows remote attackers to obtain sensitive information.
  Fixed in: 3.2.6, 3.3.3 More details: CVE-2017-15577
• Reminder sent to ex-project members

  Low
  Reminder mails were sent to assignees, even if they no longer have access to the issue itself. This may reveal sensitive information.
  Fixed in: 3.2.7, 3.3.4 More details: CVE-2017-16804

• Cross-Site Scripting (XSS)

  By exploiting an XSS vulnerability an attacker may take over your login sessions and do anything your user account would be allowed to do. If they can lure an adminstrator into their trap, they would have access to all the data stored within Redmine, enabling them to read, change and delete everything.
• Persistent XSS in textile formatting

  High
  Specially crafted input in Redmine Textile text areas would allow an attacker to insert arbitrary Javascript which in turn was executed when any user opens an affected page, e.g. an issue, wiki page, etc.
  Fixed in: 3.3.10, 3.4.11, 4.0.4
• Incomplete sanitization of multi-value custom fields

  High
  An attacker may use multi-value custom fields to embed malicious code into the issue history, the issue list, or the time log.
  Fixed in: 3.2.8, 3.3.5, 3.4.3 More details: CVE-2017-15568, CVE-2017-15569, CVE-2017-15570, CVE-2017-15571
• Cross-site scripting attack using manipulated SVG images

  High
  An attacker may attach malicious SVG images to issues or comments. When they are displayed to regular users, embeded code would be executed without their knowledge.
  Fixed in: 3.2.6, 3.3.3 More details: CVE-2017-15574
• Incomplete sanitization of user supplied text

  Moderate
  An attacker may embed malicious code into issue descriptions or comments.
  Fixed in: 3.4.13, 4.0.6
• Incomplete sanitization of user supplied text

  Moderate
  An attacker may embed malicious code into issue descriptions or comments.
  Fixed in: 3.2.6, 3.3.3 More details: CVE-2017-15573

• File Content Disclosure

  By exploiting a File Content Disclosure vulnerability, attackers may be able to download certain files from your server. In severe cases, hackers could get access to any file they wish, including the files storing your Redmine database or server passwords. In consequence, they might be able to take over the entire server by logging in using a regular user's password.
• File Content Disclosure in Rails Action View

  High
  Specially crafted accept headers in combination with calls to certain URLs within Redmine can cause arbitrary files on the target server to be rendered, disclosing the file contents.
  Fixed in: 3.3.10, 3.4.10, 4.0.3 More details: CVE-2019-5418

• Remote Code Execution (RCE)

  An RCE vulnerability allows attackers to run arbitrary code on your server. In consequence, this enables them to bypass all Redmine roles and permissions. They may read, change and delete all data stored in the Redmine database. Depending on the server configuration, they may even take over the entire server and do things like delete all backups or send out SPAM messages in your or your company's name.
• Remote Code Execution through Mercurial adapter

  High
  On Redmine installations with active Mercurial repositories, an attacker can take over the server and read and manipulate all data stored within your Redmine, possibly even take over the entire machine.
  Fixed in: 3.2.9, 3.3.6, 3.4.4 More details: CVE-2017-18026

• Server Side Request Forgery (SSRF)

  In a Server-Side Request Forgery (SSRF) attack, the attacker can abuse functionality on the server to read or update internal resources. The attacker can supply or modify a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration such as AWS metadata, connect to internal services like http enabled databases or perform post requests towards internal services which are not intended to be exposed.
• Ruby OpenID security update

  Moderate
  Ruby OpenID (aka ruby-openid) is used by Redmine to integrate with OpenID Providers. ruby-openid performed discovery first, and then verification. This allowed an attacker to change the URL used for discovery and trick the server into connecting to the URL. This server in turn could be a private server not publicly accessible.
  Fixed in: 3.3.10, 3.4.12, 4.0.5 More details: CVE-2019-11027

• Denial of Service (DOS)

  In a Denial of Service attack, your Redmine becomes compromised in a way that it does not function properly anymore. Using a Denial of Service vulnerability, attackers may not necessarily obtain or modify any data on the server, but they may render it unresponsive for users or disrupt certain functionality of your Redmine installation.
• Denial of Service Vulnerability in Rails Action View

  Moderate
  Specially crafted accept headers can cause the Action View template location code to consume 100% CPU, causing the Redmine server to be unable to process requests.
  Fixed in: 3.3.10, 3.4.10, 4.0.3 More details: CVE-2019-5419

• Reset tokens may leak to other websites

  Moderate
  Since the password reset tokens were part of the web address, users which follow links from the password reset page to other web sites, leak the token to these websites. It will appear in the log files of those external websites.
  Fixed in: 3.2.6, 3.3.3 More details: CVE-2017-15572