CVE-2009-4078: XSS
Published Nov 25, 2009
·Updated
Multiple cross-site scripting (XSS) vulnerabilities in Redmine 0.8.5 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Software
27 affected components
Redmine Redmine=0.6.0
Redmine Redmine=0.4.1
Redmine Redmine=0.7.0-rc1
Redmine Redmine=0.7.4
Redmine Redmine=0.7.0
Redmine Redmine=0.2.2
Redmine Redmine=0.7.3
Redmine Redmine=0.6.3
Redmine Redmine=0.5.0
Redmine Redmine=0.6.1
Redmine Redmine=0.7.2
Redmine Redmine=0.7.1
Redmine Redmine=0.8.4
Redmine Redmine=0.6.2
Redmine Redmine=0.4.0
Redmine Redmine=0.8.0
Redmine Redmine=0.8.0-rc1
Redmine Redmine=0.1.0
Redmine Redmine=0.6.4
Redmine Redmine=0.4.2
Redmine Redmine=0.2.1
Redmine Redmine=0.8.3
Redmine Redmine=0.5.1
Redmine Redmine=0.8.1
Redmine Redmine=0.8.2
Redmine Redmine=0.3.0
Redmine Redmine<=0.8.5
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Nov 25, 2009
CVE Published
via MITRE·09:22 PM
Data Sourced
via MITRE·09:22 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-4078?
CVE-2009-4078 is categorized as a high severity vulnerability due to its potential for remote exploitation via cross-site scripting.
2
How do I fix CVE-2009-4078?
To mitigate CVE-2009-4078, upgrade Redmine to version 0.8.6 or later, ensuring all instances are updated.
3
What products are affected by CVE-2009-4078?
CVE-2009-4078 affects Redmine versions 0.8.5 and earlier, including various versions such as 0.7.x and 0.6.x.
4
Can CVE-2009-4078 lead to data theft?
Yes, CVE-2009-4078 can enable attackers to execute scripts that may lead to data theft from affected Redmine instances.
5
Is CVE-2009-4078 a network-based vulnerability?
Yes, CVE-2009-4078 can be exploited over the network, allowing remote attackers to inject malicious scripts.