CVE-2017-15575

Name of the Vulnerable Software and Affected Versions Redmine versions prior to 3.2.6 Redmine versions 3.3.x prior to 3.3.3

Description The issue is related to the lack of a check for the Repository module in project settings in the Redmine.pm script. This could allow a remote attacker to obtain sensitive information or have other unspecified impacts.

Recommendations For Redmine versions prior to 3.2.6, update to version 3.2.6 or later. For Redmine versions 3.3.x prior to 3.3.3, update to version 3.3.3 or later. As a temporary workaround, consider disabling the Repository module in project settings until a patch is available.