CVE-2020-36308

CVE-2020-36308 affects Redmine prior to 4.0.7 and 4.1.x prior to 4.1.1. The issue lets an attacker discover the subject of a non-visible issue by exporting to CSV and reading time entries, resulting in information disclosure. Concretely, CSV export of time entries can reveal unseen issue subjects...