Vulnerability · Published Feb 6, 2024 · Assigned by GitHub_M
CVE-2024-23344Tuleap's content of artifacts might be readable by unauthorized users
Medium 5.3
In plain English
A medium-severity information exposure in tuleap from Enalean. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.5%top 55.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Tuleap is an Open Source Suite to improve management of software developments and collaboration. Some users might get access to restricted information when a process validates the permissions of multiple users (e.g. mail notifications). This issue has been patched in version 15.4.99.140 of Tuleap Community Edition.
Affected products (as reported)
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/Enalean/tuleap/security/advisories/GHSA-m3v5-2j5q-x85w x_refsource_CONFIRM
- https://github.com/Enalean/tuleap/commit/0329e21d268510bc00fed707406103edabf10e42 x_refsource_MISC
- https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=0329e21d268510bc00fed707406103edabf10e42 x_refsource_MISC
- https://tuleap.net/plugins/tracker/?aid=35862 x_refsource_MISC