CVE-2023-47258: 
Redmine vulnerability analysis and mitigation

Redmine before 4.2.11 and 5.0.x before 5.0.6 contains a Cross-Site Scripting (XSS) vulnerability in its Markdown formatter. The vulnerability was discovered and disclosed on November 5, 2023, affecting multiple versions of the Redmine project management software (NVD, Redmine Advisory).

The vulnerability has been assigned a CVSS v3.1 Base Score of 6.1 (Medium), with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability is network-accessible, requires low attack complexity, needs no privileges, but does require user interaction. The scope is changed, with low impacts on both confidentiality and integrity, while availability is not affected (NVD).

The Cross-Site Scripting vulnerability in the Markdown formatter could allow attackers to execute malicious scripts in the context of other users' browsers. This could lead to theft of sensitive information, session hijacking, or other malicious actions performed in the context of the affected user's session (Redmine Advisory).

The vulnerability requires user interaction and can be exploited through the network vector. No specific exploit code or evidence of active exploitation in the wild has been publicly reported (NVD).

The vulnerability has been fixed in Redmine versions 4.2.11 and 5.0.6. Users are strongly advised to upgrade to these or later versions to address the security issue. The fix was implemented through specific commits in the Redmine repository (Redmine Advisory).