CVE-2011-4928: XSS
Published Oct 8, 2012
·Updated
Cross-site scripting (XSS) vulnerability in the textile formatter in Redmine before 1.0.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Software
41 affected components
Redmine Redmine=0.9.0
Redmine Redmine=0.6.0
Redmine Redmine=0.4.1
Redmine Redmine=0.8.6
Redmine Redmine=0.7.0-rc1
Redmine Redmine=0.9.6
Redmine Redmine=0.7.4
Redmine Redmine=0.7.0
Redmine Redmine=0.2.2
Redmine Redmine=0.7.3
Redmine Redmine=0.6.3
Redmine Redmine=0.5.0
Redmine Redmine=0.6.1
Redmine Redmine=1.0.0
Redmine Redmine=1.0.3
Redmine Redmine=0.9.5
Redmine Redmine=0.9.2
Redmine Redmine<=1.0.4
Redmine Redmine=0.7.2
Redmine Redmine=0.7.1
Redmine Redmine=0.8.4
Redmine Redmine=0.6.2
Redmine Redmine=0.4.0
Redmine Redmine=0.8.0
Redmine Redmine=0.8.0-rc1
Redmine Redmine=0.1.0
Redmine Redmine=0.6.4
Redmine Redmine=0.4.2
Redmine Redmine=0.8.5
Redmine Redmine=0.2.1
Redmine Redmine=0.9.4
Redmine Redmine=0.9.3
Redmine Redmine=0.8.3
Redmine Redmine=0.5.1
Redmine Redmine=0.8.1
Redmine Redmine=0.8.2
Redmine Redmine=1.0.2
Redmine Redmine=0.9.1
Redmine Redmine=1.0.1
Redmine Redmine=0.3.0
Redmine Redmine=0.8.7
Event History
Oct 8, 2012
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2011-4928?
CVE-2011-4928 is considered a medium severity vulnerability due to its potential for cross-site scripting attacks.
2
How do I fix CVE-2011-4928?
To fix CVE-2011-4928, update Redmine to version 1.0.5 or later where the vulnerability has been patched.
3
What versions of Redmine are affected by CVE-2011-4928?
CVE-2011-4928 affects Redmine versions from 0.2.2 to 1.0.4.
4
How can CVE-2011-4928 be exploited?
CVE-2011-4928 can be exploited by remote attackers injecting arbitrary web scripts or HTML through unspecified vectors.
5
Is CVE-2011-4928 a serious threat to Redmine users?
Yes, CVE-2011-4928 poses a serious threat as it can lead to unauthorized actions being taken on behalf of users.