Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Redmine Atom Feed Reveals Sensitive Information

CVE-2015-8537 · published 10 years ago
Summary

A security issue in Redmine's Atom feed allows an attacker to access sensitive information if they can view the feed. This could potentially expose confidential information about your project or organization. Update to a fixed version of Redmine to protect your data.

What to do
  • Update debian redmine to version 3.2.0-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian redmine < 3.2.0-1
Fix: upgrade to 3.2.0-1
Debian:13 debian redmine < 3.2.0-1
Fix: upgrade to 3.2.0-1
– debian debian_linux 8.0
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
– redmine redmine <= 2.6.8
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.1.0
3.1.1
3.1.2
cpe:2.3:a:redmine:redmine:*:*:*:*:*:*:*:*
Original advisory text
app/views/journals/index.builder in Redmine before 2.6.9, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote attackers to obtain sensitive information by viewing an Atom feed.
app/views/journals/index.builder in Redmine before 2.6.9, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote attackers to obtain sensitive information by viewing an Atom feed.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.3 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published12 Apr 2016
Updated3 Nov 2026
First seen28 Mar 2026
Sources
DEBIAN-CVE-2015-8537 · OSV
CVE-2015-8537 · NVD
Track software like this
Free during beta