Vulnerability Description
Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles Time Entry rendering in activity views, which allows remote attackers to obtain sensitive information.
CVSS Score
7.5
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Redmine | Redmine | <= 3.2.5 |
| Debian | Debian Linux | 9.0 |
Related Weaknesses (CWE)
References
- https://www.debian.org/security/2018/dsa-4191Third Party Advisory
- https://www.redmine.org/issues/23803Permissions Required
- https://www.redmine.org/projects/redmine/wiki/Security_AdvisoriesPatchVendor Advisory
- https://www.debian.org/security/2018/dsa-4191Third Party Advisory
- https://www.redmine.org/issues/23803Permissions Required
- https://www.redmine.org/projects/redmine/wiki/Security_AdvisoriesPatchVendor Advisory
FAQ
What is CVE-2017-15576?
CVE-2017-15576 is a vulnerability with a CVSS score of 7.5 (HIGH). Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles Time Entry rendering in activity views, which allows remote attackers to obtain sensitive information.
How severe is CVE-2017-15576?
CVE-2017-15576 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-15576?
Check the references section above for vendor advisories and patch information. Affected products include: Redmine Redmine, Debian Debian Linux.