CVE:CVE-2012-0327
CNNVD:CNNVD-201203-254
Redmine是一套开源的基于Web的项目管理和缺陷跟踪工具。该工具提供项目管理、问题跟踪和基于角色的访问控制等功能。
Redmine 1.3.2之前版本中存在未明跨站脚本漏洞，该漏洞源于对用户提供的输入未经充分过滤。攻击者可利用此漏洞在受影响站点上下文的不知情用户浏览器上执行任意脚本代码，盗取基于cookie的认证证书进而发起其他攻击。
solution:Upgrade redmine redmine to a higher version than 1.3.1,0.1.0,0.2.1,0.2.2,0.3.0,0.4.0,0.4.1,0.4.2,0.5.0,0.5.1,0.6.0,0.6.1,0.6.2,0.6.3,0.6.4,0.7.0,0.7.0:rc1,0.7.1,0.7.2,0.7.3,0.7.4,0.8.0,0.8.0:rc1,0.8.1,0.8.2,0.8.3,0.8.4,0.8.5,0.8.6,0.8.7,0.9.0,0.9.1,0.9.2,0.9.3,0.9.4,0.9.5,0.9.6,1.0.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.1.0,1.1.1,1.1.2,1.1.3,1.2.0,1.2.1,1.2.2,1.2.3,1.3.0,and avoid the version (,1.3.1],0.1.0,0.2.1,0.2.2,0.3.0,0.4.0,0.4.1,0.4.2,0.5.0,0.5.1,0.6.0,0.6.1,0.6.2,0.6.3,0.6.4,0.7.0,0.7.0:rc1,0.7.1,0.7.2,0.7.3,0.7.4,0.8.0,0.8.0:rc1,0.8.1,0.8.2,0.8.3,0.8.4,0.8.5,0.8.6,0.8.7,0.9.0,0.9.1,0.9.2,0.9.3,0.9.4,0.9.5,0.9.6,1.0.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.1.0,1.1.1,1.1.2,1.1.3,1.2.0,1.2.1,1.2.2,1.2.3,1.3.0