Redmine Multiple Vulnerabilities

Bugtraq ID:	45571
Class:	Input Validation Error
CVE:	CVE-2011-4927 CVE-2011-4928 CVE-2011-4929
Remote:	Yes
Local:	No
Published:	Dec 24 2010 12:00AM
Updated:	Jan 06 2012 09:30PM
Credit:	joernchen of Phenoelit
Vulnerable:	Redmine Redmine 1.0.4 Redmine Redmine 1.0.1 Redmine Redmine 0.8.7 Redmine Redmine 0.8.6 Redmine Redmine 0.8.5 Redmine Redmine 0.7.3 Redmine Redmine 0.7.2 Redmine Redmine 1.0 Redmine Redmine 0.9 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0
Not Vulnerable:	Redmine Redmine 1.0.5

Redmine Multiple Vulnerabilities

Redmine is prone to an information-disclosure vulnerability, an HTML-injection vulnerability, and a command-injection vulnerability.

Exploiting these issues could allow an attacker to gain access to potentially sensitive information, inject arbitrary HTML code into the application, steal cookie-based authentication credentials, and execute arbitrary commands in the context of the webserver.

Redmine versions prior to 1.0.5 are vulnerable.

Redmine Multiple Vulnerabilities

An attacker can exploit these issues via a browser.

The following exploit is available:

• /data/vulnerabilities/exploits/45571.rb

Redmine Multiple Vulnerabilities

Solution:
Updates are available. Please see the references for more information.

Redmine Multiple Vulnerabilities

References:

• Redmine 1.0.5 bug/security fix released (Redmine)
  
• Vendor Homepage (Redmine)