CVE-2015-8537

Published: 12 April 2016

app/views/journals/index.builder in Redmine before 2.6.9, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote attackers to obtain sensitive information by viewing an Atom feed.

Priority

Medium

CVSS 3 base score: 5.3

Status

Package Release Status
redmine
Launchpad, Ubuntu, Debian
Upstream
Released (2.6.9, 3.0.6 and 3.1.3)
Ubuntu 18.04 LTS (Bionic Beaver) Not vulnerable
(3.2.0-1)
Ubuntu 16.04 ESM (Xenial Xerus) Not vulnerable
(3.2.0-1)
Ubuntu 14.04 ESM (Trusty Tahr) Does not exist
(trusty was needed)
Patches:
Upstream: https://github.com/redmine/redmine/commit/7e423fb4538247d59e01958c48b491f196a1de56