Vulnerability · Published Jun 25, 2024 · Assigned by GitHub_M
CVE-2024-37167Tuleap has improper permissions of the backlog items
Medium 4.3
In plain English
A medium-severity security flaw in tuleap from Enalean. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.4%top 70.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Tuleap is an Open Source Suite to improve management of software developments and collaboration. Users are able to see backlog items that they should not see. This issue has been patched in Tuleap Community Edition version 15.9.99.97.
Affected products (as reported)
Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
References
- https://github.com/Enalean/tuleap/security/advisories/GHSA-4c9f-284j-phvj x_refsource_CONFIRM
- https://github.com/Enalean/tuleap/commit/13eec93a353d2daf47bb8b9c548cc02f78b93a5e x_refsource_MISC
- https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=13eec93a353d2daf47bb8b9c548cc02f78b93a5e x_refsource_MISC
- https://tuleap.net/plugins/tracker/?aid=38297 x_refsource_MISC