PT-2022-20475 · Tuleap · Tuleap

Tgerbet + 1 · Published 2022-06-29 · Updated 2023-07-21 · CVE-2022-31032

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tuleap versions prior to 13.9.99.58

Description The issue arises from improper verification of authorizations when creating projects or trackers from projects marked as templates. This allows users to access information in those template projects due to the permissions model not being properly enforced.

Recommendations For versions prior to 13.9.99.58, upgrade to a version that includes the necessary security fixes to properly enforce the permissions model and verify authorizations.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2022-31032

GHSA-HVX6-4228-WHJ3

Affected Products

Tuleap

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31032.json · Exploit
• https://github.com/Enalean/tuleap/commit/cc38bcc59ce0c733ca915d95daec5f3082fb17ca · Patch
• https://github.com/Enalean/tuleap/commit/7e221a9d1893c13407b35008762757a76d8e5654 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-31032 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31032 · Vendor Advisory
• https://tuleap.net/plugins/tracker/?aid=26816 · Vendor Advisory
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=7e221a9d1893c13407b35008762757a76d8e5654 · Vendor Advisory
• https://github.com/Enalean/tuleap/security/advisories/GHSA-hvx6-4228-whj3 · Note
• https://docs.tuleap.org/administration-guide/users-management/security/site-access.html · Note
• https://t.me/cvenotify/33129 · Telegram Post