5.3

CVE-2021-42326

Redmine before 4.1.5 and 4.2.x before 4.2.3 may disclose the names of users on activity views due to an insufficient access filter.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Redmine ≫ Redmine Version < 4.1.5
Redmine ≫ Redmine Version >= 4.2.0 < 4.2.3
Debian ≫ Debian Linux Version9.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.13% 0.621
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://www.redmine.org/projects/redmine/wiki/Security_Advisories
Patch
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2021/10/msg00013.html
Third Party Advisory
https://www.redmine.org/news/133
Vendor Advisory
Mitigation
https://www.redmine.org/projects/redmine/wiki/Changelog_4_1#415-2021-10-10
Vendor Advisory
Release Notes
https://www.redmine.org/projects/redmine/wiki/Changelog_4_2#423-2021-10-10
Vendor Advisory
Release Notes