CVE-2021-42326

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Redmine before 4.1.5 and 4.2.x before 4.2.3 may disclose the names of users on activity views due to an insufficient access filter.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://lists.debian.org/debian-lts-announce/2021/10/msg00013.htmlThird Party Advisory
https://www.redmine.org/news/133Mitigation, Vendor Advisory
https://www.redmine.org/projects/redmine/wiki/Changelog_4_1#415-2021-10-10Release Notes, Vendor Advisory
https://www.redmine.org/projects/redmine/wiki/Changelog_4_2#423-2021-10-10Release Notes, Vendor Advisory
https://www.redmine.org/projects/redmine/wiki/Security_AdvisoriesPatch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2021/10/msg00013.htmlThird Party Advisory
https://www.redmine.org/news/133Mitigation, Vendor Advisory
https://www.redmine.org/projects/redmine/wiki/Changelog_4_1#415-2021-10-10Release Notes, Vendor Advisory
https://www.redmine.org/projects/redmine/wiki/Changelog_4_2#423-2021-10-10Release Notes, Vendor Advisory
https://www.redmine.org/projects/redmine/wiki/Security_AdvisoriesPatch, Vendor Advisory

Timeline

Published: Oct 12, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-423276.7dp_link_settings_write in drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c in the Linux kernel through 5.14.14 allows a heap-based CVE-2021-423295.4The “List_Add” function of message board of ShinHer StudyOnline System does not filter special characters in the title parameter. After logg CVE-2021-423308.8The “Teacher Edit” function of ShinHer StudyOnline System does not perform authority control. After logging in with user’s privilege, remote CVE-2021-423315.4The “Study Edit” function of ShinHer StudyOnline System does not perform permission control. After logging in with user’s privilege, remote CVE-2021-423324.3The “List View” function of ShinHer StudyOnline System is not under authority control. After logging in with user’s privilege, remote attack CVE-2021-423338.8The Easytest contains SQL injection vulnerabilities. After obtaining user’s privilege, remote attackers can inject SQL commands into the par CVE-2021-423348.8The Easytest contains SQL injection vulnerabilities. After obtaining a user’s privilege, remote attackers can inject SQL commands into the p CVE-2021-423355.4Easytest bulletin board management function of online learning platform does not filter special characters. After obtaining a user’s privile CVE-2021-423364.3The learning history page of the Easytest is vulnerable by permission bypass. After obtaining a user’s permission, remote attackers can acce CVE-2021-423374.3The permission control of AIFU cashier management salary query function can be bypassed, thus after obtaining general user’s permission, the CVE-2021-423389.84MOSAn GCB Doctor’s login page has improper validation of Cookie, which allows an unauthenticated remote attacker to bypass authentication b CVE-2021-42347.5OpenVPN Access Server 2.10 and prior versions are susceptible to resending multiple packets in a response to a reset packet sent from the cl