CVE-2020-36306

Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the backurl field...

DEBIAN-CVE-2020-36306

Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the backurl field...

CVE-2020-36306

Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the backurl field...

CVE-2020-36306

Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the backurl field...

CVE-2020-36306

CVE-2020-36306 affects Redmine up to 4.0.7 and 4.1.x up to 4.1.1, where the back_url field enables Cross-Site Scripting (XSS). Root cause: inadequate sanitization of back_url in these versions. Impact: XSS via user-supplied data in the back_url parameter; exposure depends on context. Mitigation: ...