CVE-2017-16804 In Redmine before 3.2.7 and 3.3.x before 3.3.4, the reminders function in app/models/mailer.rb does not check whether an issue is visible, which allows remote authenticated users to obtain sensitive i...
MediumCVSS 4.3
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Redmine before 3.2.7 and 3.3.x before 3.3.4, the reminders function in app/models/mailer.rb does not check whether an issue is visible, which allows remote authenticated users to obtain sensitive information by reading e-mail reminder messages.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/redmine(Debian:12) | < 3.4.2-1 | 3.4.2-1 |
| debian/redmine(Debian:13) | < 3.4.2-1 | 3.4.2-1 |
| debian/redmine(Debian:14) | < 3.4.2-1 | 3.4.2-1 |
| redmine | < 3.2.7 | 3.2.7 |
| redmine | = 3.3.0 | No fix listed |
| redmine | = 3.3.1 | No fix listed |
| redmine | = 3.3.2 | No fix listed |
| redmine | = 3.3.3 | No fix listed |
| debian linux | = 9.0 | No fix listed |
References
- Debian Security Tracker CVE-2017-16804 vendor-advisory
- github.com issue-tracking patch third-party-advisory
- DSA-4191 third-party-advisory vendor-advisory
- www.redmine.org permissions-required
- www.redmine.org issue-tracking vendor-advisory