CVE-2022-24896: Tuleap is a Free & Open Source Suite to manage software developments and collaboration. In versions prior to 13.7.99.239 Tuleap does not properly verify…

PriorityP422medium4.3CVSS 3.1

AVNACLPRLUINSUCLINAN

EPSS

0.73%

49.5th percentile

Tuleap is a Free & Open Source Suite to manage software developments and collaboration. In versions prior to 13.7.99.239 Tuleap does not properly verify authorizations when displaying the content of tracker report renderer and chart widgets. Malicious users could use this vulnerability to retrieve the name of a tracker they cannot access as well as the name of the fields used in reports.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
enalean	tuleap	< 13.6-5	13.6-5
enalean	tuleap	< 13.7.99.239	13.7.99.239
enalean	tuleap	>= 13.7-1 < 13.7-4	13.7-4

CVSS provenance

nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.