PT-2018-18173 · Enalean · Tuleap

Mustafaranon · Publicado 2018-03-01 · Atualizado 2018-03-22 · CVE-2018-7634

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Enalean Tuleap version 9.17

Description The issue is related to a lack of CSRF attack mitigation, which allows attackers to abuse the email address change functionality. This can lead to account takeover by making a victim change their registered email address on the application through a CSRF attack.

Recommendations For Enalean Tuleap version 9.17, consider implementing CSRF attack mitigation measures to prevent abuse of the email address change functionality, such as validating request tokens to ensure requests are genuine and not forged.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2018-7634

Produtos afetados

Tuleap

Referências · 7

• 🔥 https://mustafairan.wordpress.com/2018/03/05/tuleap-mail-change-csrf-vulnerability-leads-to-account-takeover · Exploit
• 🔥 https://twitter.com/Mustafaran/status/970745812887199744 · Exploit
• https://github.com/Enalean/tuleap/commit/0843c046eee54b16ec6a7753c575838212770189 · Correção
• https://tuleap.net/plugins/tracker/?aid=11217 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-7634 · Aviso do Fabricante
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?p=tuleap%2Fstable.git&a=commit&h=d6701289ae55de900929ff0f66313fa9771a198d · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-7634 · Nota de Segurança