CVE-2022-44030 - Redmine 5.x before 5.0.4 allows downloading of file attachments of any Issue or any Wiki page due to

CVE-2022-44030

Summary

Redmine 5.x before 5.0.4 allows downloading of file attachments of any Issue or any Wiki page due to insufficient permission checks. Depending on the configuration, this may require login as a registered user.

References

https://www.redmine.org/projects/redmine/wiki/Security_Advisories
https://www.redmine.org/news/139

Vulnerable Configurations

cpe:2.3:a:redmine:redmine:5.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redmine:redmine:5.0.0:*:*:*:*:*:*:*
cpe:2.3:a:redmine:redmine:5.0.1:*:*:*:*:*:*:*
cpe:2.3:a:redmine:redmine:5.0.1:*:*:*:*:*:*:*
cpe:2.3:a:redmine:redmine:5.0.2:*:*:*:*:*:*:*
cpe:2.3:a:redmine:redmine:5.0.2:*:*:*:*:*:*:*
cpe:2.3:a:redmine:redmine:5.0.3:*:*:*:*:*:*:*
cpe:2.3:a:redmine:redmine:5.0.3:*:*:*:*:*:*:*

CVSS

Base:	None
Impact:
Exploitability:

CWE

CWE-755

CAPEC

Access

Vector	Complexity	Authentication

Impact

Confidentiality	Integrity	Availability

Last major update

08-12-2022 - 19:07

Published

06-12-2022 - 23:15

Last modified

08-12-2022 - 19:07