CVE:CVE-2011-4928
CNNVD:CNNVD-201210-081
Redmine是一套开源的基于Web的项目管理和缺陷跟踪工具。该工具提供项目管理、问题跟踪和基于角色的访问控制等功能。
Redmine 1.0.5之前版本中的textile格式化程序中存在跨站脚本(XSS)漏洞。远程攻击者可利用该漏洞通过未明向量注入任意web脚本或HTML。
solution:Upgrade redmine redmine to a higher version than 1.0.4,0.1.0,0.2.1,0.2.2,0.3.0,0.4.0,0.4.1,0.4.2,0.5.0,0.5.1,0.6.0,0.6.1,0.6.2,0.6.3,0.6.4,0.7.0,0.7.0:rc1,0.7.1,0.7.2,0.7.3,0.7.4,0.8.0,0.8.0:rc1,0.8.1,0.8.2,0.8.3,0.8.4,0.8.5,0.8.6,0.8.7,0.9.0,0.9.1,0.9.2,0.9.3,0.9.4,0.9.5,0.9.6,1.0.0,1.0.1,1.0.2,1.0.3,and avoid the version (,1.0.4],0.1.0,0.2.1,0.2.2,0.3.0,0.4.0,0.4.1,0.4.2,0.5.0,0.5.1,0.6.0,0.6.1,0.6.2,0.6.3,0.6.4,0.7.0,0.7.0:rc1,0.7.1,0.7.2,0.7.3,0.7.4,0.8.0,0.8.0:rc1,0.8.1,0.8.2,0.8.3,0.8.4,0.8.5,0.8.6,0.8.7,0.9.0,0.9.1,0.9.2,0.9.3,0.9.4,0.9.5,0.9.6,1.0.0,1.0.1,1.0.2,1.0.3