PT-2023-26993 · Unknown · Tuleap Enterprise Edition+1

Tgerbet + 1 · Publicado 2023-08-24 · Atualizado 2023-08-30 · CVE-2023-39521

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Tuleap Community Edition versions prior to 14.11.99.28 Tuleap Enterprise Edition versions prior to 14.10-6 Tuleap Enterprise Edition versions prior to 14.11-3

Description The issue arises from content not being properly escaped in the "card fields" of Tuleap, which can be seen in the kanban and PV2 apps. This can lead to an agile dashboard administrator being forced to execute uncontrolled code when deleting a kanban with a malicious label.

Recommendations For Tuleap Community Edition versions prior to 14.11.99.28, update to version 14.11.99.28 or later. For Tuleap Enterprise Edition versions prior to 14.10-6, update to version 14.10-6 or later. For Tuleap Enterprise Edition versions prior to 14.11-3, update to version 14.11-3 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-39521

GHSA-H9XC-W7QQ-VPFC

Produtos afetados

Tuleap Community Edition

Tuleap Enterprise Edition

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39521.json · Exploit
• 🔥 https://tuleap.net/plugins/tracker/?aid=33656 · Exploit
• https://github.com/Enalean/tuleap/security/advisories/GHSA-h9xc-w7qq-vpfc · Aviso do Fabricante
• https://github.com/Enalean/tuleap/commit/93d10654b1d95c5bf500204666310418b01b8a8d · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-39521 · Nota de Segurança
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=93d10654b1d95c5bf500204666310418b01b8a8d · Correção
• https://t.me/cibsecurity/69163 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-39521 · Aviso do Fabricante