CVE-2015-8346: Medium severity redmine vulnerability
Published Apr 12, 2016
·Updated
app/views/timelog/form.html.erb in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote attackers to obtain sensitive information about subjects of issues by viewing the time logging form.
Affected Software
10 affected components
Redmine Redmine<=2.6.7
Redmine Redmine=3.0.0
Redmine Redmine=3.0.1
Redmine Redmine=3.0.2
Redmine Redmine=3.0.3
Redmine Redmine=3.0.4
Redmine Redmine=3.0.5
Redmine Redmine=3.1.0
Redmine Redmine=3.1.1
Debian Debian Linux=8.0
Remediation
Patch Available
Event History
Apr 12, 2016
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-8346?
CVE-2015-8346 has a medium severity rating as it allows remote attackers to access sensitive information.
2
How do I fix CVE-2015-8346?
To fix CVE-2015-8346, upgrade Redmine to version 2.6.8, 3.0.6, or 3.1.2 or later.
3
What types of software are affected by CVE-2015-8346?
CVE-2015-8346 affects Redmine versions up to 2.6.7 and versions 3.0.0 through 3.0.5 and 3.1.0 through 3.1.1.
4
What information can attackers access through CVE-2015-8346?
Attackers can access sensitive information about issues and the time logging form in Redmine.
5
Is CVE-2015-8346 exploitable remotely?
Yes, CVE-2015-8346 is exploitable remotely, allowing attackers to obtain sensitive issue data.