CVE-2017-15572
CVE-2017-15572
This page contains facts from public vulnerability sources. Check the original advisory before updating.
In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information (password reset tokens) by reading a Referer log, because account/lost_password does not use a redirect.
CVSS 7.5 · High · EPSS 2.4% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
redmine Debian:12
- Affected ranges
- ECOSYSTEM: < 3.4.2-1
Update to 3.4.2-1
redmine Debian:13
- Affected ranges
- ECOSYSTEM: < 3.4.2-1
Update to 3.4.2-1
redmine Debian:14
- Affected ranges
- ECOSYSTEM: < 3.4.2-1
Update to 3.4.2-1
redmine Ubuntu:16.04:LTS
- Versions
- 3.0~20140825-8
- 3.2.0-1
- 3.2.0-3
- 3.2.1-1
- 3.2.1-2
- 3.2.1-2ubuntu0.2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published