medium5.3
CVE-2021-42326
Redmine before 4.1.5 and 4.2.x before 4.2.3 may disclose the names of users on activity views due to an insufficient access filter.
Impact
Redmine before 4.1.5 and 4.2.x before 4.2.3 may disclose the names of users on activity views due to an insufficient access filter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redmine | Redmine | before 4.1.5 from 4.2.0 before 4.2.3 |
| Debian | Debian Linux | Version 9.0 |
References
- NVD record
- CVE.org record
- https://lists.debian.org/debian-lts-announce/2021/10/msg00013.html
- https://www.redmine.org/news/133
- https://www.redmine.org/projects/redmine/wiki/Changelog_4_1#415-2021-10-10
- https://www.redmine.org/projects/redmine/wiki/Changelog_4_2#423-2021-10-10
- https://www.redmine.org/projects/redmine/wiki/Security_Advisories
- https://lists.debian.org/debian-lts-announce/2021/10/msg00013.html
- https://www.redmine.org/news/133
- https://www.redmine.org/projects/redmine/wiki/Changelog_4_1#415-2021-10-10
- https://www.redmine.org/projects/redmine/wiki/Changelog_4_2#423-2021-10-10
- https://www.redmine.org/projects/redmine/wiki/Security_Advisories