CVE-2025-4011: Redmine Custom Query cross site scripting
A vulnerability has been found in Redmine 6.0.0/6.0.1/6.0.2/6.0.3 and classified as problematic. This vulnerability affects unknown code of the component Custom Query Handler. The manipulation of the argument Name leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 6.0.4 is able to address this issue. It is recommended to upgrade the affected component.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4011?
CVE-2025-4011 is classified as a problematic vulnerability due to its potential to allow cross-site scripting attacks.
How does CVE-2025-4011 affect Redmine?
CVE-2025-4011 affects Redmine versions 6.0.0 to 6.0.3 through the manipulation of the argument Name in the Custom Query Handler.
Can CVE-2025-4011 be exploited remotely?
Yes, CVE-2025-4011 can be initiated remotely, allowing attackers to execute malicious scripts.
What kind of attack does CVE-2025-4011 enable?
CVE-2025-4011 enables cross-site scripting (XSS) attacks, which can compromise the security of users.
How can I mitigate CVE-2025-4011?
Mitigation for CVE-2025-4011 involves upgrading Redmine to a version beyond 6.0.3 where the vulnerability is resolved.