fkie_cve-2022-39233
Vulnerability from fkie_nvd
Published
2022-10-19 11:15
Modified
2024-11-21 07:17
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Summary
Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions 12.9.99.228 and above, prior to 14.0.99.24, authorizations are not properly verified when updating the branch prefix used by the GitLab repository integration. Authenticated users can change the branch prefix of any of the GitLab repository integration they can see vie the REST endpoint `PATCH /gitlab_repositories/{id}`. This action should be restricted to Git administrators. This issue is patched in Tuleap Community Edition 14.0.99.24 and Tuleap Enterprise Edition 14.0-3. There are no known workarounds.
References
security-advisories@github.comhttps://github.com/Enalean/tuleap/commit/a06cb42d55c840d61a484472ed6b169ab23853acPatch, Third Party Advisory
security-advisories@github.comhttps://github.com/Enalean/tuleap/security/advisories/GHSA-3884-972x-3ccqThird Party Advisory
security-advisories@github.comhttps://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=a06cb42d55c840d61a484472ed6b169ab23853acPatch, Vendor Advisory
security-advisories@github.comhttps://tuleap.net/plugins/tracker/?aid=28848Exploit, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/Enalean/tuleap/commit/a06cb42d55c840d61a484472ed6b169ab23853acPatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/Enalean/tuleap/security/advisories/GHSA-3884-972x-3ccqThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=a06cb42d55c840d61a484472ed6b169ab23853acPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://tuleap.net/plugins/tracker/?aid=28848Exploit, Vendor Advisory
Impacted products
Vendor Product Version
enalean tuleap *
enalean tuleap *
enalean tuleap *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:*",
              "matchCriteriaId": "6D8CF699-74B7-4FEE-804C-1729780FA0EE",
              "versionEndExcluding": "14.0.99.24",
              "versionStartIncluding": "12.9.99.228",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "38FC5DF7-5EF5-4EE8-9B23-539CC0F8E6C9",
              "versionEndExcluding": "13.12-6",
              "versionStartIncluding": "12.10",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "B2BBE4EC-1B9E-44C6-A191-A23182941E2B",
              "versionEndExcluding": "14.0-3",
              "versionStartIncluding": "14.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Tuleap is a Free \u0026 Open Source Suite to improve management of software developments and collaboration. In versions 12.9.99.228 and above, prior to 14.0.99.24, authorizations are not properly verified when updating the branch prefix used by the GitLab repository integration. Authenticated users can change the branch prefix of any of the GitLab repository integration they can see vie the REST endpoint `PATCH /gitlab_repositories/{id}`. This action should be restricted to Git administrators. This issue is patched in Tuleap Community Edition 14.0.99.24 and Tuleap Enterprise Edition 14.0-3. There are no known workarounds."
    },
    {
      "lang": "es",
      "value": "Tuleap es una suite libre y de c\u00f3digo abierto para mejorar la administraci\u00f3n de los desarrollos de software y la colaboraci\u00f3n. En versiones 12.9.99.228 y superiores, anteriores a 14.0.99.24, las autorizaciones no son verificadas apropiadamente cuando es actualizado el prefijo de la rama usado por la integraci\u00f3n del repositorio GitLab. Los usuarios autenticados pueden cambiar el prefijo de rama de cualquiera de las integraciones de repositorios de GitLab que pueden visualizar mediante el endpoint REST \"PATCH /gitlab_repositories/{id}\". Esta acci\u00f3n deber\u00eda estar restringida a administradores de Git. Este problema est\u00e1 parcheado en Tuleap Community Edition versi\u00f3n 4.0.99.24 y Tuleap Enterprise Edition versi\u00f3n 14.0-3. No son conocidas mitigaciones"
    }
  ],
  "id": "CVE-2022-39233",
  "lastModified": "2024-11-21T07:17:50.530",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2022-10-19T11:15:11.160",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/Enalean/tuleap/commit/a06cb42d55c840d61a484472ed6b169ab23853ac"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/Enalean/tuleap/security/advisories/GHSA-3884-972x-3ccq"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit\u0026h=a06cb42d55c840d61a484472ed6b169ab23853ac"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://tuleap.net/plugins/tracker/?aid=28848"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/Enalean/tuleap/commit/a06cb42d55c840d61a484472ed6b169ab23853ac"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/Enalean/tuleap/security/advisories/GHSA-3884-972x-3ccq"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit\u0026h=a06cb42d55c840d61a484472ed6b169ab23853ac"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://tuleap.net/plugins/tracker/?aid=28848"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.