CVE-2025-24029

Опубликовано: 03 фев. 2025

Источник: nvd

CVSS3: 5.3

EPSS Низкий

Описание

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Users (possibly anonymous ones if the widget is used in the dashboard of a public project) might get access to artifacts they should not see. This issue has been addressed in Tuleap Community Edition 16.3.99.1737562605 as well as Tuleap Enterprise Edition 16.3-5 and Tuleap Enterprise Edition 16.2-7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Ссылки

https://github.com/Enalean/tuleap/security/advisories/GHSA-hq46-63pc-xfv9
Patch
Third Party Advisory
https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=269cbaa73bac6d1c50674c48c9987263f2b38804
Permissions Required
https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=a97480f951351c0f8f2f3f27f7daa3f7f9c37c75
Permissions Required
https://tuleap.net/plugins/tracker/?aid=41476
Issue Tracking
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*

Версия до 16.2-7 (исключая)

cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:*

Версия до 16.3.99.1737562605 (исключая)

cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*

Версия от 16.3 (включая) до 16.3-5 (исключая)

EPSS

Процентиль: 37%

0.00158

Низкий

5.3 Medium

CVSS3

Дефекты

CWE-280