JVNDB-2009-000074

Redmine vulnerable to cross-site request forgery

Redmine contains a cross-site request forgery vulnerability.

Redmine is a project management software. Redmine contains a cross-site request forgery vulnerability.

Yoshinari Fukumoto of Rakuten, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Base Metrics: 2.6 (Low) [IPA Score]

• Access Vector: Network
• Access Complexity: High
• Authentication: None
• Confidentiality Impact: None
• Integrity Impact: Partial
• Availability Impact: None

Redmine

• Redmine 0.8.5 and earlier

If a user views a malicious page while logged into Redmine, an arbitrary ticket may be deleted.

[Update the Software]
Update to the latest version according to the information provided by the developer.

Redmine

• Redmine : Changelog - v0.8.6
• Redmine : RubyForge - Redmine

1. JVN : JVN#87341298
2. National Vulnerability Database (NVD) : CVE-2009-4079
3. Common Vulnerabilities and Exposures (CVE) : CVE-2009-4079
4. Secunia Advisory : SA37420
5. SecurityFocus : 37066
6. ISS X-Force Database : 54334
7. VUPEN Security : VUPEN/ADV-2009-3291
8. Common Weakness Enumeration (CWE) : Cross-Site Request Forgery (CWE-352) [IPA Evaluation]

[2009/11/19]
  Web page published