Vulnerability Database

318,275

Total vulnerabilities in the database

CVE-2021-31866

Redmine before 4.0.9 and 4.1.x before 4.1.3 allows an attacker to learn the values of internal authentication keys by observing timing differences in string comparison operations within SysController and MailHandlerController.

  • Published: Apr 28, 2021
  • Updated: Nov 16, 2025
  • CVE: CVE-2021-31866
  • Severity: Medium
  • Exploit:

CVSS v3:

  • Severity: Medium
  • Score: 5.3
  • AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS v2:

  • Severity: Medium
  • Score: 5
  • AV:N/AC:L/Au:N/C:P/I:N/A:N

CWEs:

Software From Fixed in
redmine / redmine 4.1.0 4.1.3
redmine / redmine - 4.0.9
debian / debian_linux 9.0 9.0.x