PT-2023-25395 · Tuleap · Tuleap

Tgerbet + 1 · Published 2023-06-29 · Updated 2023-07-10 · CVE-2023-35938

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Tuleap versions prior to 14.9.99.63

Description The issue occurs when switching from a project visibility that allows restricted users to Private without restricted, where restricted users that are project administrators retain their access rights. These users can still access the project and perform some administration actions.

Recommendations For versions prior to 14.9.99.63, upgrade to version 14.9.99.63 to resolve the issue. As a temporary workaround, consider restricting access to project administration actions for restricted users who were project administrators before the visibility switch, until the upgrade is applied.

Exploit

Fix

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

CVE-2023-35938

GHSA-RQ42-CV6Q-3M9Q

Affected Products

Tuleap

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/35xxx/CVE-2023-35938.json · Exploit
• https://github.com/Enalean/tuleap/security/advisories/GHSA-rq42-cv6q-3m9q · Vendor Advisory
• https://github.com/Enalean/tuleap/commit/a108186e7538676c4bf6e615f793f3b787a09b91 · Patch
• https://osv.dev/vulnerability/CVE-2023-35938 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-35938 · Security Note
• https://tuleap.net/plugins/tracker/?aid=32278 · Vendor Advisory
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=a108186e7538676c4bf6e615f793f3b787a09b91 · Patch
• https://t.me/cibsecurity/65762 · Telegram Post
• https://t.me/cvenotify/53957 · Telegram Post