CVE-2021-37156

High

Redmine 4.2.0 and 4.2.1 allow existing user sessions to continue upon enabling two-factor authentication for the user's account, but the…

mitre·CWE-613·Published 2021-08-05

CVSS

7.5

EPSS

0.01

KEV

Exploits

cve.orgen

194 chars

Redmine 4.2.0 and 4.2.1 allow existing user sessions to continue upon enabling two-factor authentication for the user's account, but the intended behavior is for those sessions to be terminated.

NVDen

194 chars

Redmine 4.2.0 and 4.2.1 allow existing user sessions to continue upon enabling two-factor authentication for the user's account, but the intended behavior is for those sessions to be terminated.

Redmine versiones 4.2.0 y 4.2.1, permiten a las sesiones de usuario existentes continuar al habilitar la autenticación de dos factores para la cuenta del usuario, pero el comportamiento previsto es que esas sesiones se terminen

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
2.0	Primary	NVD	5.0	10.0	2.9	AV:N/AC:L/Au:N/C:N/I:P/A:N
3.1	Primary	NVD	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N