Multiple vulnerabilities have been identified in Redmine, which could be exploited by attackers to manipulate data or gain knowledge of sensitive information. These issues are caused by input validation errors when processing user-supplied parameters and requests, which could allow cross site request forgery or cross site scripting attacks.

Affected Products

Redmine versions 0.x

Solution

Upgrade to Redmine version 0.8.7 :
http://www.redmine.org/wiki/redmine/Download

References

http://www.vupen.com/english/advisories/2009/3291
http://www.redmine.org/wiki/redmine/Changelog#v087-2009-11-15
http://www.redmine.org/wiki/redmine/Changelog#v086-2009-11-04
http://jvn.jp/en/jp/JVN87341298/index.html
http://jvn.jp/en/jp/JVN01245481/index.html

Credits

Vulnerabilities reported by Yoshinari Fukumoto (Rakuten, Inc.).

Changelog

2009-11-19 : Initial release

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.