Medium severity5.3NVD Advisory· Published Apr 28, 2021· Updated Jun 17, 2026

CVE-2021-31866

Description

Redmine before 4.0.9 and 4.1.x before 4.1.3 allows an attacker to learn the values of internal authentication keys by observing timing differences in string comparison operations within SysController and MailHandlerController.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Redmine/Redmine3 versions
cpe:2.3:a:redmine:redmine:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:redmine:redmine:*:*:*:*:*:*:*:*range: <4.0.9
- (no CPE)
- (no CPE)range: <4.0.9, <4.1.3
Debian/linux
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
osv-coords
pkg:bitnami/redmine
Range: < 4.0.9

Patches

Vulnerability mechanics

References

lists.debian.org/debian-lts-announce/2021/05/msg00013.htmlnvdMailing ListThird Party Advisory
www.redmine.org/news/131nvdVendor Advisory
www.redmine.org/projects/redmine/wiki/Security_AdvisoriesnvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000