JVN#22182715: Redmine DMSF Plugin vulnerable to path traversal

2024-05-2900:00:00

Japan Vulnerability Notes

jvn.jp

jvn#22182715

redmine

dmsf plugin

kontron

path traversal

cwe-22

vulnerability

software update

7 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.2%

JSON

Redmine DMSF Plugin provided by Kontron contains a path traversal vulnerability (CWE-22).

Impact

When the affected version of the plugin is enabled on the Redmine instance, the logged-in user may obtain or delete arbitrary files on the server (within the privilege of the Redmine process).

Solution

Update the Software
Update the software to the latest version according to the information provided by the developer.
Version 3.1.4 has addressed this vulnerability.

Products Affected

Redmine DMSF Plugin versions prior to 3.1.4