Vulnerability · Published Dec 9, 2024 · Assigned by GitHub_M

CVE-2024-52599Tuleap vulnerable to XSS in the Gantt chart of the tracker plugin

Medium 5.4

In plain English

A medium-severity cross-site scripting in tuleap from Enalean. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.3%top 74.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Tuleap is an open source suite to improve management of software developments and collaboration. In Tuleap Community Edition prior to version 16.1.99.50 and Tuleap Enterprise Edition prior to versions 16.1-4 and 16.0-7, a malicious user with the ability to create an artifact in a tracker with a Gantt chart could force a victim to execute uncontrolled code. Tuleap Community Edition 16.1.99.50, Tuleap Enterprise Edition 16.1-4, and Tuleap Enterprise Edition 16.0-7 contain a fix.

Affected products (as reported)

Vendor	Product	Versions
Enalean	tuleap	< 16.1.99.50< 16.1-4< 16.0-7

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/Enalean/tuleap/security/advisories/GHSA-489c-fm2j-qjw7 x_refsource_CONFIRM
https://github.com/Enalean/tuleap/commit/d3686ab152b6f64ff835e7dd3c99d97b36a9d4d5 x_refsource_MISC
https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=d3686ab152b6f64ff835e7dd3c99d97b36a9d4d5 x_refsource_MISC
https://tuleap.net/plugins/tracker/?aid=40459 x_refsource_MISC