Vulnerability in Redmine

CVE-2022-44030

Redmine 5.x before 5.0.4 allows downloading of file attachments of any Issue or any Wiki page due to insufficient permission checks. Depending on the configuration, this may require login as a registered user.

EPSS: 0.006 (47.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Redmine
N/a — versions n/a

Weakness classification (CWE)

CWE-755 — Improper Handling of Exceptional Conditions

References

cve@mitre.org (Patch, Vendor Advisory)
cve@mitre.org (Release Notes, Vendor Advisory)

Frequently asked questions

What is CVE-2022-44030?: CVE-2022-44030 is a high-severity vulnerability in Redmine, classified under Improper Handling of Exceptional Conditions. CVSS score: 7.5/10. Published 2022-12-06.
How severe is CVE-2022-44030?: High severity. CVSS v3 base score is 7.5 out of 10.