CVE-2020-36308

Redmine before 4.0.7 and 4.1.x before 4.1.1 allows attackers to discover the subject of a non-visible issue by performing a CSV export and reading time entries.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:redmine:redmine:*:*:*:*:*:*:*:*
cpe:2.3:a:redmine:redmine:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2021-04-06 08:15

Updated : 2024-02-28 18:28


NVD link : CVE-2020-36308

Mitre link : CVE-2020-36308

CVE.ORG link : CVE-2020-36308


JSON object : View

Products Affected

debian

  • debian_linux

redmine

  • redmine
CWE
CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')