CVE-2022-44030

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Redmine 5.x before 5.0.4 allows downloading of file attachments of any Issue or any Wiki page due to insufficient permission checks. Depending on the configuration, this may require login as a registered user.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-755

Affected software

No affected versions have been published.

Timeline

Published: Dec 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-440316.1Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization of the blockquote sy CVE-2022-440326.4An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/cm4000_cs.c has a race condition and resultant use-after-free CVE-2022-440336.4An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/cm4040_cs.c has a race condition and resultant use-after-free CVE-2022-440346.4An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/scr24x_cs.c has a race condition and resultant use-after-free CVE-2022-440367.2In b2evolution 7.2.5, if configured with admins_can_manipulate_sensitive_files, arbitrary file upload is allowed for admins, leading to comm CVE-2022-440378.8An access control issue in APsystems ENERGY COMMUNICATION UNIT (ECU-C) Power Control Software V4.1NA, V3.11.4, W2.1NA, V4.1SAA, C1.2.2 allow CVE-2022-440389.8Russound XSourcePlayer 777D v06.08.03 was discovered to contain a remote code execution vulnerability via the scriptRunner.cgi component.CVE-2022-440399.8Franklin Fueling System FFS Colibri 1.9.22.8925 is affected by: File system overwrite. The impact is: File system rewrite (remote). ¶¶ An at CVE-2022-440489.8The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code ex CVE-2022-440499.8The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code CVE-2022-440509.8The d8s-networking for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential c CVE-2022-440519.8The d8s-stats for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code e