CVE-2015-8537

Severity: medium (CVSS 5.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-04-12 · updated 2026-06-17
Weakness: CWE-200

Description

app/views/journals/index.builder in Redmine before 2.6.9, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote attackers to obtain sensitive information by viewing an Atom feed.

Affected products

Debian Linux: 8.0
Redmine: through 2.6.8; 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5 (+4)

References

http://www.debian.org/security/2016/dsa-3529
http://www.redmine.org/news/103
https://github.com/redmine/redmine/commit/7e423fb4538247d59e01958c48b491f196a1de56
http://www.debian.org/security/2016/dsa-3529
http://www.redmine.org/news/103
https://github.com/redmine/redmine/commit/7e423fb4538247d59e01958c48b491f196a1de56

Get alerted when CVE-2015-8537 or the next vulnerability affects your stack