Cross-site scripting in Ruby Redmine



Published: 2011-04-19 | Updated: 2020-08-11
Risk Low
Patch available NO
Number of vulnerabilities 1
CVE ID CVE-2011-1723
CWE ID CWE-79
Exploitation vector Network
Public exploit Public exploit code for vulnerability #1 is available.
Vulnerable software
Subscribe
Redmine
Web applications / CRM systems

Vendor Ruby

Security Advisory

This security advisory describes one low risk vulnerability.

1) Cross-site scripting

Risk: Low

CVSSv3.1: 5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:U/RC:C] [PCI]

CVE-ID: CVE-2011-1723

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: Yes

Description

Vulnerability allows a remote attacker to perform Cross-site scripting attacks.

An input validation error exists in app/views/layouts/base.rhtml in Redmine 1.0.1 through 1.1.1 when processing PATH_INFO to projects/hg-helloworld/news/. NOTE: some of these details are obtained from third party information. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Redmine: 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5, 1.1.0, 1.1.1

CPE External links

http://osvdb.org/71564
http://secunia.com/advisories/43999
http://securityreason.com/securityalert/8211
http://www.mavitunasecurity.com/XSS-vulnerability-in-Redmine/
http://www.redmine.org/news/53
http://www.securityfocus.com/archive/1/517355/100/0/threaded
http://www.securityfocus.com/bid/47193
http://www.vupen.com/english/advisories/2011/0895
https://exchange.xforce.ibmcloud.com/vulnerabilities/66612

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.



###SIDEBAR###