CVE-2014-1985 Open redirect in n/a

What is CVE-2014-1985?

CVE-2014-1985 is a medium-severity vulnerability in Redmine Redmine, published on 11 Apr 2014. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Open redirect vulnerability in the redirect_back_or_default function in app/controllers/application_controller.rb in Redmine before 2.4.5 and 2.5.x before 2.5.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the back url (back_url parameter).

Weakness: CWE-20

Which versions are affected by CVE-2014-1985?

It affects 1 product.

Products include Redmine Redmine.

How do I fix CVE-2014-1985?

Upgrade to a fixed version.

Is CVE-2014-1985 being exploited?

There is no known exploitation of CVE-2014-1985 in the wild and no public exploit code.

Other vulnerabilities in Redmine Redmine

• CVE-2022-44030 Missing authorization in n/a High 7.5
• CVE-2021-37156 Security feature bypass in n/a High 7.5
• CVE-2011-4929 Command injection in n/a High 7.5
• CVE-2009-4079 Cross-site request forgery in n/a Medium 6.8
• CVE-2023-47258 Cross-site scripting in n/a Medium 6.1

All Redmine Redmine vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2014-1985, GHSA-m9hg-vq2w-vj4r.