CVE-2021-31863

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Insufficient input validation in the Git repository integration of Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows Redmine users to read arbitrary local files accessible by the application server process.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://lists.debian.org/debian-lts-announce/2021/05/msg00013.htmlMailing List, Third Party Advisory
https://www.redmine.org/news/131Vendor Advisory
https://www.redmine.org/projects/redmine/wiki/Security_AdvisoriesVendor Advisory
https://lists.debian.org/debian-lts-announce/2021/05/msg00013.htmlMailing List, Third Party Advisory
https://www.redmine.org/news/131Vendor Advisory
https://www.redmine.org/projects/redmine/wiki/Security_AdvisoriesVendor Advisory

Timeline

Published: Apr 28, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-318645.3Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows attackers to bypass the add_issue_notes permission requirement by le CVE-2021-318655.3Redmine before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1 allows users to circumvent the allowed filename extensions of uploaded atta CVE-2021-318665.3Redmine before 4.0.9 and 4.1.x before 4.1.3 allows an attacker to learn the values of internal authentication keys by observing timing diffe CVE-2021-318677.5Pimcore Customer Data Framework version 3.0.0 and earlier suffers from a Boolean-based blind SQL injection issue in the $id parameter of the CVE-2021-318685.4Rapid7 Nexpose version 6.6.95 and earlier allows authenticated users of the Security Console to view and edit any ticket in the legacy ticke CVE-2021-318697.5Pimcore AdminBundle version 6.8.0 and earlier suffers from a SQL injection issue in the specificID variable used by the application. This is CVE-2021-31878.8An issue was discovered in BeyondTrust Privilege Management for Mac before 5.7. An authenticated, unprivileged user can elevate privileges b CVE-2021-318709.8An issue was discovered in klibc before 2.0.9. Multiplication in the calloc() function may result in an integer overflow and a subsequent he CVE-2021-318717.5An issue was discovered in klibc before 2.0.9. An integer overflow in the cpio command may result in a NULL pointer dereference on 64-bit sy CVE-2021-318729.8An issue was discovered in klibc before 2.0.9. Multiple possible integer overflows in the cpio command on 32-bit systems may result in a buf CVE-2021-318739.8An issue was discovered in klibc before 2.0.9. Additions in the malloc() function may result in an integer overflow and a subsequent heap bu CVE-2021-318745.9Zoho ManageEngine ADSelfService Plus before 6104, in rare situations, allows attackers to obtain sensitive information about the password-sy