Medium severity6.5NVD Advisory· Published Nov 21, 2019· Updated Jun 17, 2026

CVE-2019-18890

Description

A SQL injection vulnerability in Redmine through 3.2.9 and 3.3.x before 3.3.10 allows Redmine users to access protected information via a crafted object query.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Redmine/Redmine2 versions
cpe:2.3:a:redmine:redmine:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:redmine:redmine:*:*:*:*:*:*:*:*range: <3.3.10
- (no CPE)range: <=3.2.9, <3.3.10
Debian/linux
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Redmine/Redminedescription

Patches

Vulnerability mechanics

References

security-tracker.debian.org/tracker/CVE-2019-18890nvdThird Party Advisory
www.debian.org/security/2019/dsa-4574nvdThird Party Advisory
www.redmine.org/projects/redmine/wiki/Security_AdvisoriesnvdVendor Advisory
seclists.org/bugtraq/2019/Nov/31nvd
usn.ubuntu.com/4200-1/nvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.003
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000