CVE-2015-8346

Severity: medium (CVSS 5.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-04-12 · updated 2026-06-17
Weakness: CWE-199

Description

app/views/timelog/_form.html.erb in Redmine before 2.6.8, 3.0.x before 3.0.6, and 3.1.x before 3.1.2 allows remote attackers to obtain sensitive information about subjects of issues by viewing the time logging form.

Affected products

Debian Linux: 8.0
Redmine: through 2.6.7; 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5 (+2)

References

http://www.debian.org/security/2016/dsa-3529
http://www.redmine.org/news/102
https://github.com/redmine/redmine/commit/c096dde88ff02872ba35edc4dc403c80a7867b5c
https://www.redmine.org/issues/21150
http://www.debian.org/security/2016/dsa-3529
http://www.redmine.org/news/102
https://github.com/redmine/redmine/commit/c096dde88ff02872ba35edc4dc403c80a7867b5c
https://www.redmine.org/issues/21150

Get alerted when CVE-2015-8346 or the next vulnerability affects your stack