Vulnerability identifier: #VU44156

Vulnerability risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2012-2054

CWE-ID: CWE-255

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Redmine
Web applications / CRM systems

Vendor: Ruby

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

Redmine before 1.3.2 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set attributes in the (1) Comment, (2) Document, (3) IssueCategory, (4) MembersController, (5) Message, (6) News, (7) TimeEntry, (8) Version, (9) Wiki, (10) UserPreference, or (11) Board model via a modified URL, related to a "mass assignment" vulnerability, a different vulnerability than CVE-2012-0327.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Redmine: 0.1.0 - 1.3.0

---

External links
http://www.redmine.org/boards/2/topics/29343
http://www.redmine.org/issues/10390
http://www.redmine.org/versions/42

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.