CVE-2021-37156: High severity Redmine Redmine vulnerability
Published Aug 5, 2021
·Updated
Redmine 4.2.0 and 4.2.1 allow existing user sessions to continue upon enabling two-factor authentication for the user's account, but the intended behavior is for those sessions to be terminated.
Affected Software
2 affected components
Redmine Redmine=4.2.0
Redmine Redmine=4.2.1
Event History
Aug 5, 2021
CVE Published
via MITRE·08:36 PM
Data Sourced
via MITRE·08:36 PM
Description
Data Sourced
via NVD·09:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID for this Redmine vulnerability?
The vulnerability ID for this Redmine vulnerability is CVE-2021-37156.
2
What is the severity of CVE-2021-37156?
The severity of CVE-2021-37156 is high.
3
Which versions of Redmine are affected by CVE-2021-37156?
Redmine versions 4.2.0 and 4.2.1 are affected by CVE-2021-37156.
4
What is the intended behavior that is not being followed in CVE-2021-37156?
The intended behavior is for existing user sessions to be terminated upon enabling two-factor authentication, but in CVE-2021-37156, those sessions continue.
5
Are there any references available for CVE-2021-37156?
Yes, you can find references for CVE-2021-37156 at the following links: [Link 1](https://www.redmine.org/news/132), [Link 2](https://www.redmine.org/projects/redmine/wiki/Security_Advisories)