Redmine Security Report for version 3.4.11
Redmine 3.4.11 was released 10 months ago on June 10, 2019. It is subject to 3 known vulnerabilities.
What now?
We strongly recommend you update your Redmine to the latest version.
Not enough time to keep Redmine secure?
Move to Professionally Hosted Redmine by Planio.
Move to Professionally Hosted Redmine by Planio.
Detailed Analysis
-
Cross-Site Scripting (XSS)
By exploiting an XSS vulnerability an attacker may take over your login sessions and do anything your user account would be allowed to do. If they can lure an adminstrator into their trap, they would have access to all the data stored within Redmine, enabling them to read, change and delete everything. -
Incomplete sanitization of user supplied textModerateAn attacker may embed malicious code into issue descriptions or comments.
-
Information Leak
By exploiting an information leak, an attacker may see pieces of information, which would otherwise be hidden, effectively circumventing Redmine's roles and permissions. -
Possible Information Leak / Session Hijack VulnerabilityModerateBy carefully measuring the amount of time it takes to look up a session (timing attack), an attacker may be able to find a valid session id and hijack the session.Fixed in:
4.0.6More details: CVE-2019-16782
-
Server Side Request Forgery (SSRF)
In a Server-Side Request Forgery (SSRF) attack, the attacker can abuse functionality on the server to read or update internal resources. The attacker can supply or modify a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to read server configuration such as AWS metadata, connect to internal services like http enabled databases or perform post requests towards internal services which are not intended to be exposed. -
Ruby OpenID security updateModerateRuby OpenID (aka ruby-openid) is used by Redmine to integrate with OpenID Providers. ruby-openid performed discovery first, and then verification. This allowed an attacker to change the URL used for discovery and trick the server into connecting to the URL. This server in turn could be a private server not publicly accessible.