Vulnerabilities > CVE-2011-4929 - Unspecified vulnerability in Redmine

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
redmine
exploit available
metasploit
NVD
Published: 2012-10-08
Updated: 2012-10-09

Summary

Unspecified vulnerability in the bazaar repository adapter in Redmine 0.9.x and 1.0.x before 1.0.5 allows remote attackers to execute arbitrary commands via unknown vectors.

Vulnerable Configurations

Part Description Count
Application
Redmine
12

Exploit-Db

descriptionRedmine SCM Repository - Arbitrary Command Execution (Metasploit). CVE-2011-4929. Remote exploit for Linux platform
idEDB-ID:41695
last seen2017-03-23
modified2010-12-19
published2010-12-19
reporterExploit-DB
sourcehttps://www.exploit-db.com/download/41695/
titleRedmine SCM Repository - Arbitrary Command Execution (Metasploit)

Metasploit

descriptionThis module exploits an arbitrary command execution vulnerability in the Redmine repository controller. The flaw is triggered when a rev parameter is passed to the command line of the SCM tool without adequate filtering.
idMSF:EXPLOIT/UNIX/WEBAPP/REDMINE_SCM_EXEC
last seen2020-05-21
modified2017-07-24
published2010-12-25
references
reporterRapid7
sourcehttps://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/unix/webapp/redmine_scm_exec.rb
titleRedmine SCM Repository Arbitrary Command Execution

References