Redmine Security Report for version 5.0.3
Redmine 5.0.3 was released over 1 year ago on October 03, 2022. It is subject to 12 known vulnerabilities.
What now?
We strongly recommend you update your Redmine to the latest version.
Not enough time to keep Redmine secure?
Move to Professionally Hosted Redmine by Planio.
Move to Professionally Hosted Redmine by Planio.
Detailed Analysis
-
Privilege Escalation
By exploiting a privilege escalation vulnerability, an attacker may be able to perform actions which they would otherwise not be allowed to perform, effectively circumventing Redmine's roles and permissions. -
Inadequate Access Control in Attachments DownloadCriticalBy crafting URLs, an attacker may download the file attachments of any issue or wiki page due to inadequate permission checks. Depending on the Redmine configuration, this may require prior login with a registered user.Fixed in:
5.0.4More details: CVE-2022-44030 -
Insufficient permission checks when adding attachments to issuesModerateDue to missing permission checks, Redmine might allow unauthorized users to add attachments to issues when could not otherwise edit. Accessing existing attachments is not affected by this.
-
Cross-Site Scripting (XSS)
By exploiting an XSS vulnerability an attacker may take over your login sessions and do anything your user account would be allowed to do. If they can lure an adminstrator into their trap, they would have access to all the data stored within Redmine, enabling them to read, change and delete everything. -
XSS in Markdown formatterHighBy submitting crafted markup to a Redmine which is configured to use the legacy Markdown formatter, an attacker can inject malicious JavaScript code into submitted Markdown text. Depending on the Redmine configuration, this may require prior login with a registered user.
-
XSS in Textile formatterHighBy submitting crafted markup to a Redmine which is configured to use Textile formatting, an attacker can inject malicious JavaScript code into submitted Textile text. Depending on the Redmine configuration, this may require prior login with a registered user.
-
XSS in image thumbnailsHighBy submitting specifically crafted image attachments to a Redmine, an attacker may inject malicious JavaScript code into Redmine which may be executed within the Redmine origin. Depending on the Redmine configuration, this may require prior login with a registered user.
-
Persistent XSS in textile formatting due to blockquote citationHighBy submitting crafted markup to a Redmine which is configured to use Textile formatting, an attacker can inject malicious JavaScript code into submitted Textile text. Depending on the Redmine configuration, this may require prior login with a registered user.
-
Persistent XSS in textile formattingHighBy submitting crafted markup to a Redmine which is configured to use Textile formatting, an attacker can inject malicious JavaScript code into submitted Textile text. Depending on the Redmine configuration, this may require prior login with a registered user.
-
Denial of Service (DOS)
In a Denial of Service attack, your Redmine becomes compromised in a way that it does not function properly anymore. Using a Denial of Service vulnerability, attackers may not necessarily obtain or modify any data on the server, but they may render it unresponsive for users or disrupt certain functionality of your Redmine installation. -
Update packaged libxml2 in NokogiriModerateUpdates in the packaged dependencies libxml2 (to 2.10.4) of Nokogiri addresses various security issues, having multiple and partially unspecified impact including dereferencing NULL pointers and potentially segfaulting while parsing untrusted inputs, as well as various logic or memory errors, including double frees. Updates for Nokogiri are available when using Ruby 2.7 or newer.
-
Various vulnerabilities in NokogiriModerateVarious vulnerabilities in Nokigiri and its bundled libxml and libz libraries were fixed in Nokogiri 1.13.10. Updates for Nokogiri are available when using Ruby 2.6 or newer.Fixed in:
4.2.10,5.0.5More details: CVE-2022-2309, CVE-2022-40304, CVE-2022-40303, CVE-2022-37434, CVE-2022-23476 -
Unbounded resource exhaustion in cmark-gfm autolink extension may lead to denial of serviceModerateA polynomial time complexity issue in cmark-gfm's autolink extension used by the commonmarker gem may lead to unbounded resource exhaustion and subsequent denial of service. This vulnerability can only be triggered if you use the CommonMark Markdown text formatting.Fixed in:
5.0.4More details: CVE-2022-39209
-
Open Redirect
By exploiting an open redirect vulnerability an attacker may lure a user on to a phishing site (e.g. a fake login form) using a legitimately looking link. This usually increases the likelihood of users to fall for this kind of attack. With a stolen password, the attacker may take over the user's account and view, change or delete anything the user would be allowed to. -
Open Redirect in Attachments DownloadModerateDue to missing sanitization, the bulk attachments download feature in Redmine might allow attackers to redirect users to arbitrary extermal websites after a download attempt.
-
Information Leak
By exploiting an information leak, an attacker may see pieces of information, which would otherwise be hidden, effectively circumventing Redmine's roles and permissions. -
Double-render error with ApplicationController#find_optional_projectLowBy crafting URLs and observing responses to those URLs, an attacker might learn the existence of private projects.