medium4.3
CVE-2015-8473
The Issues API in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote authenticated users to obtain sensitive information in changes…
Impact
The Issues API in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote authenticated users to obtain sensitive information in changeset messages by leveraging permission to read issues with related changesets from other projects.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Debian | Debian Linux | Version 8.0 |
| Redmine | Redmine | through 2.6.7 Versions 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.debian.org/security/2016/dsa-3529
- http://www.securityfocus.com/bid/78621
- https://github.com/redmine/redmine/commit/8d8f612fa368a72c56b63f7ce6b7e98cab9feb22
- https://www.redmine.org/issues/21136
- https://www.redmine.org/projects/redmine/wiki/Changelog_3_0
- https://www.redmine.org/projects/redmine/wiki/Changelog_3_1
- https://www.redmine.org/versions/105
- http://www.debian.org/security/2016/dsa-3529
- http://www.securityfocus.com/bid/78621
- https://github.com/redmine/redmine/commit/8d8f612fa368a72c56b63f7ce6b7e98cab9feb22
- https://www.redmine.org/issues/21136
- https://www.redmine.org/projects/redmine/wiki/Changelog_3_0
- https://www.redmine.org/projects/redmine/wiki/Changelog_3_1
- https://www.redmine.org/versions/105