CVE-2022-44637

NameCVE-2022-44637
DescriptionRedmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization in Redcloth3 Textile-formatted fields. Depending on the configuration, this may require login as a registered user.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1026048

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
redmine (PTS)stretch (security), stretch (lts), stretch3.3.1-4+deb9u5vulnerable
bookworm (security), bookworm5.0.4-5+deb12u1fixed
sid5.1.3+ds-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
redminesourcestretch(unfixed)end-of-life
redminesource(unstable)5.0.4-11026048

Notes

https://www.redmine.org/projects/redmine/wiki/Security_Advisories
Search for package or bug name: Reporting problems