JVN#13618065: Redmine vulnerable to cross-site scripting

Redmine contains a cross-site scripting vulnerability (CWE-79) due to improper character string processing.

Impact

An arbitrary script may be executed on the web browser of the user who is using the product.

Solution

Update the Software
Update the software to the latest version according to the information provided by the developer.
The developer has released the following versions that contain a fix for this vulnerability.

• Redmine version 4.2.11
• Redmine version 5.0.6

Products Affected

• Redmine versions 4.2.10 and earlier
• Redmine versions 5.0.0 to 5.0.5