CVE-2017-16804

    Dashboard / Vulnerabilities / CVE-2017-16804

    CVE-2017-16804

    Published: 13 Nov 2017Last Modified: 8 Jul 2026

    Summary:

    Details: In Redmine before 3.2.7 and 3.3.x before 3.3.4, the reminders function in app/models/mailer.rb does not check whether an issue is visible, which allows remote authenticated users to obtain sensitive information by reading e-mail reminder messages.

    References: https://www.debian.org/security/2018/dsa-4191, https://www.redmine.org/issues/25713, https://www.redmine.org/projects/redmine/wiki/Security_Advisories, https://github.com/redmine/redmine/commit/0f09f161f64f4190a52166675ff380a15b72a8bc

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -fb97158c976c41911e3e875136b21055c294084e

    Affected versions

    3.3.0
    3.3.1
    3.3.2
    3.3.3

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2017-16804 | CVE-DB