CVE-2022-44030

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-12-06 · updated 2026-06-17
Weakness: CWE-755

Description

Redmine 5.x before 5.0.4 allows downloading of file attachments of any Issue or any Wiki page due to insufficient permission checks. Depending on the configuration, this may require login as a registered user.

Affected products

Redmine: from 5.0.0 through 5.0.3

References

https://www.redmine.org/news/139
https://www.redmine.org/projects/redmine/wiki/Security_Advisories
https://www.redmine.org/news/139
https://www.redmine.org/projects/redmine/wiki/Security_Advisories

Get alerted when CVE-2022-44030 or the next vulnerability affects your stack