app/views/timelog/_form.html.erb in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote attackers to obtain sensitive information about subjects of issues by viewing the time logging form.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Redmine | Redmine | * | 2.6.7 (including) |
| Redmine | Redmine | 3.0.0 (including) | 3.0.0 (including) |
| Redmine | Redmine | 3.0.1 (including) | 3.0.1 (including) |
| Redmine | Redmine | 3.0.2 (including) | 3.0.2 (including) |
| Redmine | Redmine | 3.0.3 (including) | 3.0.3 (including) |
| Redmine | Redmine | 3.0.4 (including) | 3.0.4 (including) |
| Redmine | Redmine | 3.0.5 (including) | 3.0.5 (including) |
| Redmine | Redmine | 3.1.0 (including) | 3.1.0 (including) |
| Redmine | Redmine | 3.1.1 (including) | 3.1.1 (including) |
| Redmine | Ubuntu | precise | * |
| Redmine | Ubuntu | trusty | * |
| Redmine | Ubuntu | upstream | * |
| Redmine | Ubuntu | vivid | * |
| Redmine | Ubuntu | wily | * |
| Redmine | Ubuntu | yakkety | * |
| Redmine | Ubuntu | zesty | * |
References
- http://www.debian.org/security/2016/dsa-3529
- http://www.redmine.org/news/102
- https://github.com/redmine/redmine/commit/c096dde88ff02872ba35edc4dc403c80a7867b5c
- https://www.redmine.org/issues/21150
- http://www.debian.org/security/2016/dsa-3529
- http://www.redmine.org/news/102
- https://github.com/redmine/redmine/commit/c096dde88ff02872ba35edc4dc403c80a7867b5c
- https://www.redmine.org/issues/21150