Redmine CVE-2024-44735 Shares API Information Disclosure Vulnerability Analysis

Vulnerability Overview Vulnerability Name: Shares API Information Disclosure Vulnerability Type: Information Disclosure Severity: Medium (CVSS v3 base metrics: 6.5 / 10) CVE ID: CVE-2024-44735 CWE ID: CWE-863 Description: The endpoint returns detailed information about all work packages in a project, accessible to any user with the permission. The authorization check is performed only at the project level and does not verify whether the requesting user is actually authorized to view each individual work package. This allows regular project members to discover: Work package IDs and subjects (including confidential titles) Which users have been granted sharing permissions Assigned role levels (editor, commenter, viewer) Affected Versions Affected Versions: <= 17.3.1, < 17.4.0 Fixed Versions: 17.3.2, 17.4.0 Root Cause In lines 47-53, the code fails to correctly filter work package visibility. Reproduction Steps 1. Create a private project containing two regular members (User A and User B). 2. Create a work package (WP#1) within the project. 3. As an administrator, share WP#1 with an external User C using the "editor" role. 4. As User A (who is not part of the sharing), call the following API: 5. The response includes sharing information for WP#1, revealing: Impact Any authenticated project member with the permission can enumerate the sharing status of all work packages in the project. In environments with entity-level access control, this results in the leakage of confidential work package titles, sharing relationships, and role assignments. Remediation Add work package visibility filtering to the scope: Reporter Reporter: DAVIDAROCA27

Goal Reached Thanks to every supporter — we hit 100%!

Redmine CVE-2024-44735 Shares API Information Disclosure Vulnerability Analysis

More from this source