Log in Start free

Vulnerability · Published Aug 24, 2023 · Assigned by GitHub_M

CVE-2023-39521Tuleap vulnerable to Cross-site Scripting on the success message of a kanban deletion

Medium 4.8

In plain English

A medium-severity cross-site scripting in tuleap from Enalean. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)4.8Medium
Exploit odds (30 days)0.6%top 53.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Tuleap is an open source suite to improve management of software developments and collaboration. In Tuleap Community Edition prior to version 14.11.99.28 and Tuleap Enterprise Edition prior to versions 14.10-6 and 14.11-3, content displayed in the "card fields" (visible in the kanban and PV2 apps) is not properly escaped. An agile dashboard administrator deleting a kanban with a malicious label can be forced to execute uncontrolled code. Tuleap Community Edition 14.11.99.28, Tuleap Enterprise Edition 14.10-6, and Tuleap Enterprise Edition 14.11-3 contain a fix for this issue.

Affected products (as reported)

VendorProductVersions
Enalean tuleap Tuleap Community Edition < 14.11.99.28Tuleap Enterprise Edition < 14.10-6Tuleap Enterprise Edition >= 14.11, < 14.11-3

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

References