Mass Assignment Vulnerability in Redmine Package
Summary
DEBIAN-CVE-2012-2054: Redmine before 1.3.2 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set attributes in the (1) Comment, (2) Document, (3) IssueCategory, (4) Membe... Affects redmine versions < 1.3.2+dfsg1-1. Fixed in 1.3.2+dfsg1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Redmine is a flexible project management web application that provides support for multiple projects. It includes features like issue tracking, project wikis, and forums. However, prior to version 1.3.2, Redmine had a vulnerability that allowed unauthorized attribute modification through a hash in the URL, potentially compromising the integrity of various models.
Vulnerability Detail
The vulnerability, identified as CVE-2012-2054, arises from Redmine's failure to properly restrict the use of a hash for model attributes. This flaw enables remote attackers to manipulate attributes in critical models such as Comment, Document, IssueCategory, and others via a modified URL. The implications of this vulnerability can lead to unauthorized access and manipulation of sensitive data, posing a significant risk to the application's security.
How To Fix
Minimum fixed version
1.3.2+dfsg1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade redmineTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict access to the application or implement additional authentication measures until the package can be updated. This may include using firewall rules or application-level access controls to limit exposure.
Conclusion
The mass assignment vulnerability in Redmine poses a significant risk to users of the application. It is crucial to update to the latest version to mitigate potential threats. Regular monitoring and security practices should be implemented to safeguard against such vulnerabilities.
See every vulnerability recorded for redmine →
FAQ
CVE-2012-2054 is a vulnerability in Redmine that allows attackers to modify model attributes through a hash in the URL.
If you are using a version of Redmine prior to 1.3.2, your installation is vulnerable. You can check your version in the application settings or by running 'redmine --version'.
The risks include unauthorized access to sensitive data and potential manipulation of project-related information, which can compromise project integrity.
Yes, tools like Vulert can monitor your application for open-source vulnerabilities in real-time using a manifest file like package-lock.json.
Detailed information can be found in the official CVE database or by visiting the Debian security advisory related to this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for redmine.
