Lucene search

GitHub_MCVE-2022-24896

HistoryJun 09, 2022 - 6:15 a.m.

CVE-2022-24896

2022-06-0906:15:07

CWE-862

GitHub_M

web.nvd.nist.gov

tuleap

cve-2022-24896

software development

collaboration

vulnerability

authorization verification

tracker report

chart widgets

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.5

Confidence

High

EPSS

0.001

Percentile

33.0%

JSON

Tuleap is a Free & Open Source Suite to manage software developments and collaboration. In versions prior to 13.7.99.239 Tuleap does not properly verify authorizations when displaying the content of tracker report renderer and chart widgets. Malicious users could use this vulnerability to retrieve the name of a tracker they cannot access as well as the name of the fields used in reports.

Affected configurations

Nvd

Vulners

Node

enaleantuleapRange<13.6-5enterprise

enaleantuleapRange<13.7.99.239community

enaleantuleapRange13.7-1–13.7-4enterprise

VendorProductVersionCPE
enaleantuleap*cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*
enaleantuleap*cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:*

Vendor	Product	Version	CPE
enalean	tuleap	*	cpe:2.3:a:enalean:tuleap:::::enterprise:::*
enalean	tuleap	*	cpe:2.3:a:enalean:tuleap:::::community:::*

CNA Affected

[
  {
    "product": "tuleap",
    "vendor": "Enalean",
    "versions": [
      {
        "status": "affected",
        "version": "< 13.7.99.239"
      }
    ]
  }
]

References

github.com/Enalean/tuleap/commit/8e99e7c82d9fe569799019b9e1d614d38a184313

github.com/Enalean/tuleap/security/advisories/GHSA-x962-x43g-qw39

tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=8e99e7c82d9fe569799019b9e1d614d38a184313

tuleap.net/plugins/tracker/?aid=26729

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.5

Confidence

High

EPSS

0.001

Percentile

33.0%

JSON

Related for CVE-2022-24896