CVE-2015-8537: Infoleak
Published Apr 12, 2016
·Updated
app/views/journals/index.builder in Redmine before 2.6.9, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote attackers to obtain sensitive information by viewing an Atom feed.
Affected Software
12 affected components
Debian Debian Linux=8.0
Redmine Redmine<=2.6.8
Redmine Redmine=3.0.0
Redmine Redmine=3.0.1
Redmine Redmine=3.0.2
Redmine Redmine=3.0.3
Redmine Redmine=3.0.4
Redmine Redmine=3.0.5
Redmine Redmine=3.0.6
Redmine Redmine=3.1.0
Redmine Redmine=3.1.1
Redmine Redmine=3.1.2
Remediation
Patch Available
Event History
Apr 12, 2016
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-8537?
CVE-2015-8537 is classified as a moderate severity vulnerability due to its potential to expose sensitive information.
2
How do I fix CVE-2015-8537?
To fix CVE-2015-8537, upgrade Redmine to version 2.6.9, 3.0.7, or 3.1.3 or later.
3
What does CVE-2015-8537 allow attackers to do?
CVE-2015-8537 allows remote attackers to obtain sensitive information by accessing an insecure Atom feed.
4
Which versions of Redmine are affected by CVE-2015-8537?
CVE-2015-8537 affects Redmine versions prior to 2.6.9, 3.0.x versions before 3.0.7, and 3.1.x versions before 3.1.3.
5
Is CVE-2015-8537 a remote or local vulnerability?
CVE-2015-8537 is a remote vulnerability as it can be exploited by attackers over the network.