p PatchFirst

CVE-2012-2054

CVE-2012-2054

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Redmine before 1.3.2 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set attributes in the (1) Comment, (2) Document, (3) IssueCategory, (4) MembersController, (5) Message, (6) News, (7) TimeEntry, (8) Version, (9) Wiki, (10) UserPreference, or (11) Board model via a modified URL, related to a "mass assignment" vulnerability, a different vulnerability than CVE-2012-0327.

EPSS 2.1% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • redmine Debian:12

    Affected ranges
    • ECOSYSTEM: < 1.3.2+dfsg1-1

    Update to 1.3.2+dfsg1-1

  • redmine Debian:13

    Affected ranges
    • ECOSYSTEM: < 1.3.2+dfsg1-1

    Update to 1.3.2+dfsg1-1

  • redmine Debian:14

    Affected ranges
    • ECOSYSTEM: < 1.3.2+dfsg1-1

    Update to 1.3.2+dfsg1-1

Original sources

Check your server →