Remote Code Execution in Redmine by Attacking Repository Module Settings

CVE-2017-15575

What is CVE-2017-15575?

In Redmine versions prior to 3.2.6 and 3.3.x up to 3.3.3, a flaw exists where the Redmine.pm script does not verify if the Repository module is enabled in project settings. This oversight may permit remote attackers to extract sensitive difference information related to code or documents contained within the repository. The lack of adequate validation increases the risk of potentially broader negative impacts, emphasizing the need for users to ensure they are running updated versions to mitigate risks associated with this vulnerability.

References