Vulnerability · Published Jun 6, 2022 · Assigned by GitHub_M

CVE-2022-24896Tracker report renderer and chart widgets leak information in Tuleap

Medium 4.3

In plain English

A medium-severity missing authorization in tuleap from Enalean. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.8%top 43.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Tuleap is a Free & Open Source Suite to manage software developments and collaboration. In versions prior to 13.7.99.239 Tuleap does not properly verify authorizations when displaying the content of tracker report renderer and chart widgets. Malicious users could use this vulnerability to retrieve the name of a tracker they cannot access as well as the name of the fields used in reports.

Affected products (as reported)

Vendor	Product	Versions
Enalean	tuleap	< 13.7.99.239

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/Enalean/tuleap/security/advisories/GHSA-x962-x43g-qw39 x_refsource_CONFIRM
https://github.com/Enalean/tuleap/commit/8e99e7c82d9fe569799019b9e1d614d38a184313 x_refsource_MISC
https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=8e99e7c82d9fe569799019b9e1d614d38a184313 x_refsource_MISC
https://tuleap.net/plugins/tracker/?aid=26729 x_refsource_MISC