Servers and applications
CVE-2012-2054
Redmine before 1.3.2 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set attributes in the (1) Comment, (2) Document, (3) IssueCategory, (4) MembersController, (5) Message, (6) News, (7) TimeEntry, (8) Version, (9) Wiki, (10) UserPreference, or (11) Board model via a modified URL, related to a "mass assignment"…
- Severity
- Medium 5.0
- Published
- 5 Apr 2012
- Last changed
- 16 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Exploit chance
- 2.1% in the next 30 daysHigher than 81% of CVEs. EPSS by FIRST, 12 Nov 2026
- Weakness
- CWE-255
- Attack
- Over the network · No login needed
- Attacker can
- Change some data
- CVSS vector
AV:N/AC:L/Au:N/C:N/I:P/A:N- Sources
- NVD
Description
Redmine before 1.3.2 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set attributes in the (1) Comment, (2) Document, (3) IssueCategory, (4) MembersController, (5) Message, (6) News, (7) TimeEntry, (8) Version, (9) Wiki, (10) UserPreference, or (11) Board model via a modified URL, related to a "mass assignment" vulnerability, a different vulnerability than CVE-2012-0327.
Affected software
| Software | Affected versions |
|---|---|
RedmineServers and applications · cpe:a:redmine:redmine |
All 52 release lines
|