{"api_version":"1","generated_at":"2026-04-21T17:01:17+00:00","cve":"CVE-2021-31863","urls":{"html":"https://cve.report/CVE-2021-31863","api":"https://cve.report/api/cve/CVE-2021-31863.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-31863","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-31863"},"summary":{"title":"CVE-2021-31863","description":"Insufficient input validation in the Git repository integration of Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows Redmine users to read arbitrary local files accessible by the application server process.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2021-04-28 07:15:00","updated_at":"2021-06-01 13:27:00"},"problem_types":["CWE-20"],"metrics":[],"references":[{"url":"https://www.redmine.org/news/131","name":"https://www.redmine.org/news/131","refsource":"MISC","tags":[],"title":"Redmine 4.2.1, 4.1.3 and 4.0.9 released (security fixes) - Redmine","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.redmine.org/projects/redmine/wiki/Security_Advisories","name":"https://www.redmine.org/projects/redmine/wiki/Security_Advisories","refsource":"MISC","tags":[],"title":"Security Advisories - Redmine","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.debian.org/debian-lts-announce/2021/05/msg00013.html","name":"[debian-lts-announce] 20210513 [SECURITY] [DLA 2658-1] redmine security update","refsource":"MLIST","tags":[],"title":"[SECURITY] [DLA 2658-1] redmine security update","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-31863","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-31863","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2021","cve_id":"31863","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"9.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"31863","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redmine","cpe5":"redmine","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2021-31863","qid":"178591","title":"Debian Security Update for redmine (DLA 2658-1)"},{"cve":"CVE-2021-31863","qid":"182003","title":"Debian Security Update for redmine (CVE-2021-31863)"}]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2021-31863","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Insufficient input validation in the Git repository integration of Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows Redmine users to read arbitrary local files accessible by the application server process."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"url":"https://www.redmine.org/projects/redmine/wiki/Security_Advisories","refsource":"MISC","name":"https://www.redmine.org/projects/redmine/wiki/Security_Advisories"},{"url":"https://www.redmine.org/news/131","refsource":"MISC","name":"https://www.redmine.org/news/131"},{"refsource":"MLIST","name":"[debian-lts-announce] 20210513 [SECURITY] [DLA 2658-1] redmine security update","url":"https://lists.debian.org/debian-lts-announce/2021/05/msg00013.html"}]}},"nvd":{"publishedDate":"2021-04-28 07:15:00","lastModifiedDate":"2021-06-01 13:27:00","problem_types":["CWE-20"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5},"severity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:redmine:redmine:*:*:*:*:*:*:*:*","versionStartIncluding":"4.1.0","versionEndExcluding":"4.1.3","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:redmine:redmine:*:*:*:*:*:*:*:*","versionStartIncluding":"4.2.0","versionEndExcluding":"4.2.1","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:redmine:redmine:*:*:*:*:*:*:*:*","versionEndExcluding":"4.0.9","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"31863","Ordinal":"207177","Title":"CVE-2021-31863","CVE":"CVE-2021-31863","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"31863","Ordinal":"1","NoteData":"Insufficient input validation in the Git repository integration of Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows Redmine users to read arbitrary local files accessible by the application server process.","Type":"Description","Title":null},{"CveYear":"2021","CveId":"31863","Ordinal":"2","NoteData":"2021-04-28","Type":"Other","Title":"Published"},{"CveYear":"2021","CveId":"31863","Ordinal":"3","NoteData":"2021-05-13","Type":"Other","Title":"Modified"}]}}}