fkie_cve-2025-24029
Vulnerability from fkie_nvd
Published
2025-02-03 22:15
Modified
2025-08-22 15:59
Severity ?
Summary
Tuleap is an Open Source Suite to improve management of software developments and collaboration. Users (possibly anonymous ones if the widget is used in the dashboard of a public project) might get access to artifacts they should not see. This issue has been addressed in Tuleap Community Edition 16.3.99.1737562605 as well as Tuleap Enterprise Edition 16.3-5 and Tuleap Enterprise Edition 16.2-7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| security-advisories@github.com | https://github.com/Enalean/tuleap/security/advisories/GHSA-hq46-63pc-xfv9 | Third Party Advisory, Patch | |
| security-advisories@github.com | https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=269cbaa73bac6d1c50674c48c9987263f2b38804 | Permissions Required | |
| security-advisories@github.com | https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=a97480f951351c0f8f2f3f27f7daa3f7f9c37c75 | Permissions Required | |
| security-advisories@github.com | https://tuleap.net/plugins/tracker/?aid=41476 | Vendor Advisory, Issue Tracking, Patch |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "7C94363E-3A6A-431B-B09E-82607147B52D",
"versionEndExcluding": "16.2-7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:*",
"matchCriteriaId": "B0A6CE6F-83BA-4D5C-B686-A30701402260",
"versionEndExcluding": "16.3.99.1737562605",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "ACECC850-13ED-4516-BC1F-01FB9153332B",
"versionEndExcluding": "16.3-5",
"versionStartIncluding": "16.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Tuleap is an Open Source Suite to improve management of software developments and collaboration. Users (possibly anonymous ones if the widget is used in the dashboard of a public project) might get access to artifacts they should not see. This issue has been addressed in Tuleap Community Edition 16.3.99.1737562605 as well as Tuleap Enterprise Edition 16.3-5 and Tuleap Enterprise Edition 16.2-7. Users are advised to upgrade. There are no known workarounds for this vulnerability."
},
{
"lang": "es",
"value": "Tuleap es una suite de c\u00f3digo abierto que mejora la gesti\u00f3n de los desarrollos de software y la colaboraci\u00f3n. Los usuarios (posiblemente an\u00f3nimos si el widget se utiliza en el panel de control de un proyecto p\u00fablico) podr\u00edan obtener acceso a artefactos que no deber\u00edan ver. Este problema se ha solucionado en Tuleap Community Edition 16.3.99.1737562605, as\u00ed como en Tuleap Enterprise Edition 16.3-5 y Tuleap Enterprise Edition 16.2-7. Se recomienda a los usuarios que actualicen la versi\u00f3n. No se conocen workarounds para esta vulnerabilidad."
}
],
"id": "CVE-2025-24029",
"lastModified": "2025-08-22T15:59:15.257",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
},
"published": "2025-02-03T22:15:28.320",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Third Party Advisory",
"Patch"
],
"url": "https://github.com/Enalean/tuleap/security/advisories/GHSA-hq46-63pc-xfv9"
},
{
"source": "security-advisories@github.com",
"tags": [
"Permissions Required"
],
"url": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit\u0026h=269cbaa73bac6d1c50674c48c9987263f2b38804"
},
{
"source": "security-advisories@github.com",
"tags": [
"Permissions Required"
],
"url": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit\u0026h=a97480f951351c0f8f2f3f27f7daa3f7f9c37c75"
},
{
"source": "security-advisories@github.com",
"tags": [
"Vendor Advisory",
"Issue Tracking",
"Patch"
],
"url": "https://tuleap.net/plugins/tracker/?aid=41476"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-280"
}
],
"source": "security-advisories@github.com",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…