Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2017-15570 Details

In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/views/timelog/_list.html.erb via crafted column data.

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:6.1 MEDIUMVector:CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/redmine/redmine/commit/1a0976417975a128b0a932ba1552c37e9414953b	CVE	PatchThird Party Advisory
https://www.debian.org/security/2018/dsa-4191	CVE	Third Party Advisory
https://www.redmine.org/issues/27186	CVE	Permissions RequiredVendor Advisory
https://www.redmine.org/projects/redmine/wiki/Security_Advisories	CVE	PatchVendor Advisory
https://github.com/redmine/redmine/commit/1a0976417975a128b0a932ba1552c37e9414953b	[email protected]	PatchThird Party Advisory
https://www.debian.org/security/2018/dsa-4191	[email protected]	Third Party Advisory
https://www.redmine.org/issues/27186	[email protected]	Permissions RequiredVendor Advisory
https://www.redmine.org/projects/redmine/wiki/Security_Advisories	[email protected]	PatchVendor Advisory

CWE-ID	CWE Name	Source
CWE-79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	[email protected]

Product	Versions
redmine redmine	<= 3.2.7 3.3.0 3.3.1 3.3.2 3.3.3
CPE cpe:2.3:a:redmine:redmine:::::::: cpe:2.3:a:redmine:redmine:3.3.0:::::::* cpe:2.3:a:redmine:redmine:3.3.1:::::::* cpe:2.3:a:redmine:redmine:3.3.2:::::::* cpe:2.3:a:redmine:redmine:3.3.3:::::::* cpe:2.3:a:redmine:redmine:3.3.4:::::::* cpe:2.3:a:redmine:redmine:3.4.0:::::::* cpe:2.3:a:redmine:redmine:3.4.1:::::::* cpe:2.3:a:redmine:redmine:3.4.2:::::::* Remediation No remediation found in references.
debian debian linux	9.0
CPE cpe:2.3:o:debian:debian_linux:9.0:::::::* Remediation No remediation found in references.

7 change records found show changes

QUICK INFO