Log in Start free

Vulnerability · Published Jun 29, 2023 · Assigned by GitHub_M

CVE-2023-35938User access not updated with privilege change in Tuleap

Medium 4.1

In plain English

A medium-severity security flaw in tuleap from Enalean. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)4.1Medium
Exploit odds (30 days)0.6%top 51.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. When switching from a project visibility that allows restricted users to `Private without restricted`, restricted users that are project administrators keep this access right. Restricted users that were project administrators before the visibility switch keep the possibility to access the project and do some administration actions. This issue has been resolved in Tuleap version 14.9.99.63. Users are advised to upgrade. There are no known workarounds for this issue.

Affected products (as reported)

VendorProductVersions
Enalean tuleap < 14.9.99.63

Weakness: CWE-281 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L

References