Vulnerability Details : CVE-2017-15572
In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information (password reset tokens) by reading a Referer log, because account/lost_password does not use a redirect.
Products affected by CVE-2017-15572
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:a:redmine:redmine:*:*:*:*:*:*:*:*
- cpe:2.3:a:redmine:redmine:3.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:redmine:redmine:3.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:redmine:redmine:3.3.2:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-15572
0.35%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 69 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-15572
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST | |
|
7.5
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2017-15572
-
The product writes sensitive information to a log file.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-15572
-
https://www.redmine.org/issues/24416
RedminePermissions Required;Vendor Advisory
-
https://www.debian.org/security/2018/dsa-4191
Debian -- Security Information -- DSA-4191-1 redmineThird Party Advisory
-
https://www.redmine.org/projects/redmine/wiki/Security_Advisories
Security Advisories - RedminePatch;Vendor Advisory
Jump to