CVE-2021-30164: Critical severity redmine vulnerability
Published Apr 6, 2021
·Updated
Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to bypass the addissuenotes permission requirement by leveraging the Issues API.
Affected Software
3 affected components
Redmine Redmine<4.0.8
Redmine Redmine>=4.1.0<4.1.2
Debian Debian Linux=9.0
Event History
Apr 6, 2021
CVE Published
via MITRE·07:58 AM
Data Sourced
via MITRE·07:58 AM
Description
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-30164.
2
What is the severity rating of CVE-2021-30164?
The severity rating of CVE-2021-30164 is critical with a score of 9.8.
3
How does CVE-2021-30164 allow attackers to bypass the add_issue_notes permission requirement?
CVE-2021-30164 allows attackers to bypass the add_issue_notes permission requirement by leveraging the Issues API.
4
Which versions of Redmine are affected by CVE-2021-30164?
Redmine versions before 4.0.8 and 4.1.x before 4.1.2 are affected by CVE-2021-30164.
5
Is there a fix available for CVE-2021-30164?
Yes, a fix is available for CVE-2021-30164. Users should update to Redmine version 4.0.8 or 4.1.2.