Sensitive Information Exposure in Redmine by Redirection Flaw
CVE-2017-15572

7.5HIGH

Key Information:

Vendor: Redmine
Status: Redmine
Vendor: CVE Published:; 18 October 2017

What is CVE-2017-15572?

In specific versions of Redmine prior to 3.2.6 and 3.3.x versions before 3.3.3, a security flaw exists that can allow remote attackers to access sensitive information, such as password reset tokens. This vulnerability arises from the improper handling of requests related to the password recovery process, wherein the application does not perform a redirect, leaving the information accessible through Referer headers.