CVE-2017-15572 - In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information (password reset tokens) by reading a Referer log, because account/lost_password does not use a redirect · CoreCVE

Back Back to CVE browser

HIGH

In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information (password reset tokens) by reading a Referer log, because account/lost_password does not use a redirect

Published Oct 18, 2017

7.5

HIGH

CVSS 3.0

EPSS 2.40%

Description

In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information (password reset tokens) by reading a Referer log, because account/lost_password does not use a redirect.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-532

References (3)

https://www.debian.org/security/2018/dsa-4191
vendor-advisoryx_refsource_DEBIANThird Party Advisory
https://www.redmine.org/issues/24416
x_refsource_CONFIRMPermissions RequiredVendor Advisory
https://www.redmine.org/projects/redmine/wiki/Security_Advisories
x_refsource_CONFIRMPatchVendor Advisory

Link	Providers	Tags
https://www.debian.org/security/2018/dsa-4191		vendor-advisoryx_refsource_DEBIANThird Party Advisory
https://www.redmine.org/issues/24416		x_refsource_CONFIRMPermissions RequiredVendor Advisory
https://www.redmine.org/projects/redmine/wiki/Security_Advisories		x_refsource_CONFIRMPatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Oct 18, 2017

Updated Aug 5, 2024

Reserved Oct 17, 2017

Link CVE-2017-15572

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2017-15572

Red Hat

Severity n/a

Public date n/a

Links CVE-2017-15572