CVE-2021-30163: 
Redmine vulnerability analysis and mitigation

Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to discover the names of private projects if issue-journal details exist that have changes to project_id values. This vulnerability was assigned CVE-2021-30163 and was disclosed on April 6, 2021. The vulnerability affects multiple versions of Redmine, a popular project management web application (Redmine Security, CVE Details).

The vulnerability is classified as a moderate severity information disclosure issue with a CVSS score of 7.5 (High). The security flaw exists in the issue-journal details functionality where changes to project_id values could expose private project names. This vulnerability specifically relates to information leakage through the journal details mechanism (Ubuntu CVE).

The primary impact of this vulnerability is the potential disclosure of private project names through issue-journal details. This information leak could expose sensitive project information to unauthorized users, compromising the confidentiality of private projects within Redmine installations (Redmine Security).

The vulnerability can be exploited by attackers who have access to issue-journal details containing project_id changes. The exploitation requires no special privileges beyond basic access to the Redmine instance (Debian LTS).

The vulnerability was fixed in Redmine versions 4.0.8 and 4.1.2. Users are strongly recommended to upgrade to these or later versions. For Debian 9 stretch users, the fix was included in version 3.3.1-4+deb9u4 (Debian LTS).