Persistent XSS Vulnerability in Redmine Affects Multiple Versions
CVE-2019-17427
Key Information:
Badges
What is CVE-2019-17427?
A persistent Cross-Site Scripting vulnerability has been identified in Redmine versions earlier than 3.4.11 and in 4.0.x prior to 4.0.4. This vulnerability arises from errors in textile formatting, allowing an attacker to inject malicious scripts that could be stored and executed on clients' browsers. Exploiting this flaw could result in unauthorized actions being performed on behalf of authenticated users, potentially leading to data theft or manipulation. Organizations using the affected versions are strongly advised to update to the latest secure release to mitigate the risks associated with this vulnerability.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.