CVE:CVE-2009-4459
CNNVD:CNNVD-200912-398
Redmine是一套开源的基于Web的项目管理和缺陷跟踪工具。该工具提供项目管理、问题跟踪和基于角色的访问控制等功能。
Redmine没有正确地定义页面字符编码，将<title>放到了<meta>之前。攻击者可以创建标题编码为UTF-7 JavaScript的页面，当使用启用了自动选择功能的Internet Explorer查看该页面就会执行内嵌的代码。
solution:Upgrade redmine redmine to a higher version than 0.8.7,0.1.0,0.2.1,0.2.2,0.3.0,0.4.0,0.4.1,0.4.2,0.5.0,0.5.1,0.6.0,0.6.1,0.6.2,0.6.3,0.6.4,0.7.0,0.7.0:rc1,0.7.1,0.7.2,0.7.3,0.7.4,0.8.0,0.8.0:rc1,0.8.1,0.8.2,0.8.3,0.8.4,0.8.5,0.8.6,and avoid the version (,0.8.7],0.1.0,0.2.1,0.2.2,0.3.0,0.4.0,0.4.1,0.4.2,0.5.0,0.5.1,0.6.0,0.6.1,0.6.2,0.6.3,0.6.4,0.7.0,0.7.0:rc1,0.7.1,0.7.2,0.7.3,0.7.4,0.8.0,0.8.0:rc1,0.8.1,0.8.2,0.8.3,0.8.4,0.8.5,0.8.6