Summary
It was discovered that Redmine incorrectly handle certain inputs that could
cause textile formatting errors. An attacker could possibly use this issue to
cause a XSS attack. (CVE-2019-17427)
It was discovered that an SQL injection could allow users to access protected
information via a crafted object query. (CVE-2019-18890)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | redmine | 3.2.1-2ubuntu0.2 |
| Ubuntu · 18.04 LTS 18.04:LTS | redmine | 3.4.4-1ubuntu0.1 |
Vulnerabilities 2
-
Unscored —CVE-2019-17427 Public exploit
In Redmine before 3.4.11 and 4.0.x before 4.0.4, persistent XSS exists due to textile formatting errors.
-
Unscored —CVE-2019-18890 Public exploit
A SQL injection vulnerability in Redmine through 3.2.9 and 3.3.x before 3.3.10 allows Redmine users to access protected…