Log in Start free

Vulnerability · Published Feb 3, 2025 · Assigned by GitHub_M

CVE-2025-24029Artifact permissions are not verified in the Cross Tracker Search widget in Tuleap

Medium 5.3

In plain English

A medium-severity security flaw in tuleap from Enalean. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.4%top 71.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Users (possibly anonymous ones if the widget is used in the dashboard of a public project) might get access to artifacts they should not see. This issue has been addressed in Tuleap Community Edition 16.3.99.1737562605 as well as Tuleap Enterprise Edition 16.3-5 and Tuleap Enterprise Edition 16.2-7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products (as reported)

VendorProductVersions
Enalean tuleap < 16.3.99.1737562605

Weakness: CWE-280 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References