CVE-2015-8473: Infoleak
Published Apr 12, 2016
·Updated
The Issues API in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote authenticated users to obtain sensitive information in changeset messages by leveraging permission to read issues with related changesets from other projects.
Affected Software
10 affected components
Debian Debian Linux=8.0
Redmine Redmine<=2.6.7
Redmine Redmine=3.0.0
Redmine Redmine=3.0.1
Redmine Redmine=3.0.2
Redmine Redmine=3.0.3
Redmine Redmine=3.0.4
Redmine Redmine=3.0.5
Redmine Redmine=3.1.0
Redmine Redmine=3.1.1
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Apr 12, 2016
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-8473?
CVE-2015-8473 is considered to be a medium severity vulnerability.
2
How do I fix CVE-2015-8473?
To fix CVE-2015-8473, upgrade Redmine to version 2.6.8 or 3.0.6 or later.
3
What does CVE-2015-8473 affect?
CVE-2015-8473 affects Redmine versions prior to 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2.
4
Can CVE-2015-8473 be exploited by unauthenticated users?
No, CVE-2015-8473 can only be exploited by remote authenticated users.
5
What information can be exposed due to CVE-2015-8473?
CVE-2015-8473 allows remote authenticated users to obtain sensitive information in changeset messages.