Atisne

**Name of the Vulnerable Software and Affected Versions** Tuleap Community Edition versions prior to 15.5.99.76 Tuleap Enterprise Edition versions prior to 15.5-4 Tuleap Enterprise Edition versions prior to 15.4-7 **Description** Tuleap is an open source suite to improve management of software developments and collaboration. Users with read access to a tracker where the mass update feature is used might get access to restricted information. **Recommendations** For Tuleap Community Edition versions prior to 15.5.99.76, update to version 15.5.99.76 to resolve the issue. For Tuleap Enterprise Edition versions prior to 15.5-4, update to version 15.5-4 to resolve the issue. For Tuleap Enterprise Edition versions prior to 15.4-7, update to version 15.4-7 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Tuleap Community Edition versions prior to 14.11.99.28 Tuleap Enterprise Edition versions prior to 14.10-6 Tuleap Enterprise Edition versions prior to 14.11-3 **Description** The preview of an artifact link with a type in Tuleap does not respect project, tracker, and artifact level permissions. This issue occurs on the artifact view and allows users to access information they should not have access to, including the title, status, assigned to, and last update date fields. However, strict permissions on these fields are still enforced. **Recommendations** For Tuleap Community Edition versions prior to 14.11.99.28, update to version 14.11.99.28 or later. For Tuleap Enterprise Edition versions prior to 14.10-6, update to version 14.10-6 or later. For Tuleap Enterprise Edition versions prior to 14.11-3, update to version 14.11-3 or later.