PT-2023-26487 · Unknown · Tuleap Enterprise Edition+1
Atisne
·
Publicado
2023-08-24
·
Atualizado
2023-08-30
·
CVE-2023-38508
CVSS v3.1
6.5
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Tuleap Community Edition versions prior to 14.11.99.28
Tuleap Enterprise Edition versions prior to 14.10-6
Tuleap Enterprise Edition versions prior to 14.11-3
Description
The preview of an artifact link with a type in Tuleap does not respect project, tracker, and artifact level permissions. This issue occurs on the artifact view and allows users to access information they should not have access to, including the title, status, assigned to, and last update date fields. However, strict permissions on these fields are still enforced.
Recommendations
For Tuleap Community Edition versions prior to 14.11.99.28, update to version 14.11.99.28 or later.
For Tuleap Enterprise Edition versions prior to 14.10-6, update to version 14.10-6 or later.
For Tuleap Enterprise Edition versions prior to 14.11-3, update to version 14.11-3 or later.
Exploit
Correção
Improper Authorization
Missing Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Tuleap Community Edition
Tuleap Enterprise Edition