PT-2023-25395 · Tuleap · Tuleap

Tgerbet + 1 · Publicado 2023-06-29 · Atualizado 2023-07-10 · CVE-2023-35938

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Média

Vetor base

AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Tuleap versions prior to 14.9.99.63

Description The issue occurs when switching from a project visibility that allows restricted users to Private without restricted, where restricted users that are project administrators retain their access rights. These users can still access the project and perform some administration actions.

Recommendations For versions prior to 14.9.99.63, upgrade to version 14.9.99.63 to resolve the issue. As a temporary workaround, consider restricting access to project administration actions for restricted users who were project administrators before the visibility switch, until the upgrade is applied.

Exploit

Correção

Improper Preservation of Permissions

Enumeração de Fraquezas

CWE-281

Identificadores relacionados

CVE-2023-35938

GHSA-RQ42-CV6Q-3M9Q

Produtos afetados

Tuleap

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35938.json · Exploit
• https://github.com/Enalean/tuleap/security/advisories/GHSA-rq42-cv6q-3m9q · Aviso do Fabricante
• https://github.com/Enalean/tuleap/commit/a108186e7538676c4bf6e615f793f3b787a09b91 · Correção
• https://osv.dev/vulnerability/CVE-2023-35938 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-35938 · Nota de Segurança
• https://t.me/cibsecurity/65762 · Publicação no Telegram
• https://tuleap.net/plugins/tracker/?aid=32278 · Aviso do Fabricante
• https://t.me/cvenotify/53957 · Publicação no Telegram
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=a108186e7538676c4bf6e615f793f3b787a09b91 · Correção