JVNDB-2009-000073

Redmine vulnerable to cross-site scripting

Redmine contains a cross-site scripting vulnerability.

Redmine is a project management software. Redmine contains a cross-site scripting vulnerability.

Yoshinari Fukumoto of Rakuten, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Base Metrics: 4.0 (Medium) [IPA Score]

• Access Vector: Network
• Access Complexity: Low
• Authentication: Single Instance
• Confidentiality Impact: None
• Integrity Impact: Partial
• Availability Impact: None

Redmine

• Redmine 0.8.5 and earlier

An arbitrary script may be executed on the user's web browser. As a result, cookie information may be leaked and could lead to session hijacking or user impersonation.

[Update the Software]
Update to the latest version according to the information provided by the developer.

Redmine

• Redmine : Changelog - v0.8.6
• Redmine : RubyForge - Redmine

1. JVN : JVN#01245481
2. National Vulnerability Database (NVD) : CVE-2009-4078
3. Common Vulnerabilities and Exposures (CVE) : CVE-2009-4078
4. Secunia Advisory : SA37420
5. SecurityFocus : 37066
6. ISS X-Force Database : 54333
7. VUPEN Security : VUPEN/ADV-2009-3291
8. Common Weakness Enumeration (CWE) : Cross-site scripting (CWE-79) [IPA Evaluation]

[2009/11/19]
  Web page published