Lucene search

GitHub_MCVE-2022-23473

HistoryDec 13, 2022 - 7:15 a.m.

CVE-2022-23473

2022-12-1307:15:09

CWE-863

GitHub_M

web.nvd.nist.gov

tuleap

cve-2022-23473

mediawiki

authorization

vulnerability

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

4.4

Confidence

High

EPSS

0.001

Percentile

29.1%

JSON

Tuleap is an Open Source Suite to improve management of software developments and collaboration. In versions prior to 14.2.99.148, Authorizations are not properly verified when accessing MediaWiki standalone resources. Users with read only permissions for pages are able to also edit them. This only affects the MediaWiki standalone plugin. This issue is patched in versions Tuleap Community Edition 14.2.99.148, Tuleap Enterprise Edition 14.2-5, and Tuleap Enterprise Edition 14.1-6.

Affected configurations

Nvd

Vulners

Node

enaleantuleapRange<14.1-6enterprise

enaleantuleapRange<14.2.99.148community

enaleantuleapRange14.2-1–14.2-5enterprise

VendorProductVersionCPE
enaleantuleap*cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*
enaleantuleap*cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:*

Vendor	Product	Version	CPE
enalean	tuleap	*	cpe:2.3:a:enalean:tuleap:::::enterprise:::*
enalean	tuleap	*	cpe:2.3:a:enalean:tuleap:::::community:::*

CNA Affected

[
  {
    "vendor": "Enalean",
    "product": "tuleap",
    "versions": [
      {
        "version": "< 14.2.99.148",
        "status": "affected"
      }
    ]
  }
]

References

github.com/Enalean/tuleap/security/advisories/GHSA-c7rr-5vmc-rgcw

tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=97cac78302170a883c1d60c9fa6dfd0d95854cb9

tuleap.net/plugins/tracker/?aid=29645

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

4.4

Confidence

High

EPSS

0.001

Percentile

29.1%

JSON

Related for CVE-2022-23473