CVE-2009-4459
30.12.2009, 20:00
Redmine 0.8.7 and earlier uses the title tag before defining the character encoding in a meta tag, which allows remote attackers to conduct cross-site scripting (XSS) attacks and inject arbitrary script via UTF-7 encoded values in the title parameter to a new issue page, which may be interpreted as script by Internet Explorer 7 and 8.
| Vendor | Product | Version |
|---|---|---|
| redmine | redmine | 𝑥 ≤ 0.8.7 |
| redmine | redmine | 0.1.0 |
| redmine | redmine | 0.2.1 |
| redmine | redmine | 0.2.2 |
| redmine | redmine | 0.3.0 |
| redmine | redmine | 0.4.0 |
| redmine | redmine | 0.4.1 |
| redmine | redmine | 0.4.2 |
| redmine | redmine | 0.5.0 |
| redmine | redmine | 0.5.1 |
| redmine | redmine | 0.6.0 |
| redmine | redmine | 0.6.1 |
| redmine | redmine | 0.6.2 |
| redmine | redmine | 0.6.3 |
| redmine | redmine | 0.6.4 |
| redmine | redmine | 0.7.0 |
| redmine | redmine | 0.7.0:rc1 |
| redmine | redmine | 0.7.1 |
| redmine | redmine | 0.7.2 |
| redmine | redmine | 0.7.3 |
| redmine | redmine | 0.7.4 |
| redmine | redmine | 0.8.0 |
| redmine | redmine | 0.8.0:rc1 |
| redmine | redmine | 0.8.1 |
| redmine | redmine | 0.8.2 |
| redmine | redmine | 0.8.3 |
| redmine | redmine | 0.8.4 |
| redmine | redmine | 0.8.5 |
| redmine | redmine | 0.8.6 |
𝑥
= Vulnerable software versions
Debian Releases
