Vulnerability · Published Dec 13, 2022 · Assigned by GitHub_M

CVE-2022-23473Tuleap MediaWiki standalone "readers" can also edit pages

Medium 4.3

In plain English

A medium-severity incorrect authorization in tuleap from Enalean. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.5%top 58.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Tuleap is an Open Source Suite to improve management of software developments and collaboration. In versions prior to 14.2.99.148, Authorizations are not properly verified when accessing MediaWiki standalone resources. Users with read only permissions for pages are able to also edit them. This only affects the MediaWiki standalone plugin. This issue is patched in versions Tuleap Community Edition 14.2.99.148, Tuleap Enterprise Edition 14.2-5, and Tuleap Enterprise Edition 14.1-6.

Affected products (as reported)

Vendor	Product	Versions
Enalean	tuleap	< 14.2.99.148

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

https://github.com/Enalean/tuleap/security/advisories/GHSA-c7rr-5vmc-rgcw x_refsource_CONFIRM
https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=97cac78302170a883c1d60c9fa6dfd0d95854cb9 x_refsource_MISC
https://tuleap.net/plugins/tracker/?aid=29645 x_refsource_MISC