Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.1

Redmine: Malicious Data Can Be Injected into Issue List

CVE-2017-15569 · published 9 years ago
Summary

Redmine versions before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3 are affected. An attacker could inject malicious data into issue lists, potentially stealing user information or taking control of accounts. Update to a fixed version to protect your system.

What to do
  • Update debian redmine to version 3.4.4-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian redmine < 3.4.4-1
Fix: upgrade to 3.4.4-1
Debian:13 debian redmine < 3.4.4-1
Fix: upgrade to 3.4.4-1
– redmine redmine <= 3.2.7
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
3.4.0
3.4.1
3.4.2
cpe:2.3:a:redmine:redmine:*:*:*:*:*:*:*:*
– debian debian_linux 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Original advisory text
In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/queries_helper.rb via a multi-value field with a crafted value that is mishandled during rendering of ...
In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS exists in app/helpers/queries_helper.rb via a multi-value field with a crafted value that is mishandled during rendering of an issue list.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.1 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published18 Oct 2017
Updated3 Nov 2026
First seen28 Mar 2026
Sources
DEBIAN-CVE-2017-15569 · OSV
CVE-2017-15569 · NVD
Track software like this
Free during beta