CVE

Id
55297  
CVE No.
CVE-2012-2054  
Status
Candidate  
Description
Redmine before 1.3.2 does not properly restrict the use of a hash to provide values for a model"s attributes, which allows remote attackers to set attributes in the (1) Comment, (2) Document, (3) IssueCategory, (4) MembersController, (5) Message, (6) News, (7) TimeEntry, (8) Version, (9) Wiki, (10) UserPreference, or (11) Board model via a modified URL, related to a "mass assignment" vulnerability, a different vulnerability than CVE-2012-0327.  
Phase
Assigned (20120404)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
577656 55297 CVE-2012-2054 CONFIRM:http://www.redmine.org/boards/2/topics/29343  View
577657 55297 CVE-2012-2054 CONFIRM:http://www.redmine.org/issues/10390  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
28734 JVNDB-2012-004441 Drupal 用 ticketyboo News Ticker モジュールにおけるクロスサイトスクリプティングの脆弱性 Drupal 用 ticketyboo News Ticker モジュールには、クロスサイトスクリプティングの脆弱性が存在します。 CVE-2012-2059 55297 4.3 http://jvndb.jvn.jp/ja/contents/2012/JVNDB-2012-004441.html  View