PT-2023-25386 · Unknown · Tuleap Enterprise Edition+1

Tgerbet + 1 · Published 2023-07-25 · Updated 2023-08-02 · CVE-2023-35929

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Tuleap Community Edition versions prior to 14.10.99.4 Tuleap Enterprise Edition versions prior to 14.10-2 and 14.9-5

Description The issue affects the display of content in "card fields" within the kanban and PV2 apps, where the content is not properly escaped. This could allow a malicious user with the capability to create an artifact or edit a field used as a card field to force a victim to execute uncontrolled code.

Recommendations For Tuleap Community Edition versions prior to 14.10.99.4, update to version 14.10.99.4 or later. For Tuleap Enterprise Edition versions prior to 14.10-2, update to version 14.10-2 or later. For Tuleap Enterprise Edition versions prior to 14.9-5, update to version 14.9-5 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-35929

GHSA-XHJP-4RJF-Q268

Affected Products

Tuleap Community Edition

Tuleap Enterprise Edition

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35929.json · Exploit
• https://github.com/Enalean/tuleap/commit/0b2945fbd260d37aa0aff2ca1c867d160f76188d · Patch
• https://github.com/Enalean/tuleap/security/advisories/GHSA-xhjp-4rjf-q268 · Vendor Advisory
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=0b2945fbd260d37aa0aff2ca1c867d160f76188d · Patch
• https://osv.dev/vulnerability/CVE-2023-35929 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-35929 · Security Note
• https://tuleap.net/plugins/tracker/?aid=32629 · Vendor Advisory
• https://t.me/tomhunter/1669 · Telegram Post
• https://t.me/irozysk/9888 · Telegram Post