CVE-2021-31863: 
Redmine vulnerability analysis and mitigation

CVE-2021-31863 is a critical security vulnerability discovered in Redmine's Git repository integration. The vulnerability affects Redmine versions before 4.0.9, 4.1.x before 4.1.3, and 4.2.x before 4.2.1. It was disclosed on April 28, 2021, and allows Redmine users to read arbitrary local files that are accessible by the application server process due to insufficient input validation (NVD, Redmine News).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. This indicates that the vulnerability can be exploited remotely with low attack complexity, requires no privileges or user interaction, and primarily impacts confidentiality while having no direct effect on integrity or availability. The vulnerability is classified under CWE-20 (Improper Input Validation) (NVD).

The vulnerability enables unauthorized access to local files that are accessible by the application server process, potentially leading to sensitive information disclosure. This could allow attackers to read configuration files, source code, or other sensitive data stored on the server (Redmine Security).

The vulnerability can be exploited by any Redmine user who has access to the Git repository integration feature. For systems that cannot update immediately, a mitigation method is to update the Git version on the server to at least 2.22.0 (Redmine News).

The vulnerability has been fixed in Redmine versions 4.0.9, 4.1.3, and 4.2.1. Users are strongly recommended to upgrade to these versions or later as soon as possible. For those who cannot update immediately, updating the Git version on the server to at least 2.22.0 can help mitigate the risk (Redmine News).

The vulnerability was reported by niubl from TSRC (Tencent Security Response Center) to the Redmine security team. The discovery and fix involved collaboration between security researchers and the Redmine development team, including significant contributions from Holger Just from www.plan.io (Redmine News).