Log in Start free

Vulnerability · Published Feb 22, 2024 · Assigned by GitHub_M

CVE-2024-25130Tuleap's mass update clears the permissions on artifact field

Medium 5.4

In plain English

A medium-severity information exposure in tuleap from Enalean. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.5%top 57.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Tuleap is an open source suite to improve management of software developments and collaboration. Prior to version 15.5.99.76 of Tuleap Community Edition and prior to versions 15.5-4 and 15.4-7 of Tuleap Enterprise Edition, users with a read access to a tracker where the mass update feature is used might get access to restricted information. Tuleap Community Edition 15.5.99.76, Tuleap Enterprise Edition 15.5-4, and Tuleap Enterprise Edition 15.4-7 contain a patch for this issue.

Affected products (as reported)

VendorProductVersions
Enalean tuleap < 15.5.99.76>= 15.5, < 15.5-4< 15.4-7

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N

References