PT-2023-26487 · Unknown · Tuleap Enterprise Edition+1

Atisne · Published 2023-08-24 · Updated 2023-08-30 · CVE-2023-38508

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tuleap Community Edition versions prior to 14.11.99.28 Tuleap Enterprise Edition versions prior to 14.10-6 Tuleap Enterprise Edition versions prior to 14.11-3

Description The preview of an artifact link with a type in Tuleap does not respect project, tracker, and artifact level permissions. This issue occurs on the artifact view and allows users to access information they should not have access to, including the title, status, assigned to, and last update date fields. However, strict permissions on these fields are still enforced.

Recommendations For Tuleap Community Edition versions prior to 14.11.99.28, update to version 14.11.99.28 or later. For Tuleap Enterprise Edition versions prior to 14.10-6, update to version 14.10-6 or later. For Tuleap Enterprise Edition versions prior to 14.11-3, update to version 14.11-3 or later.

Exploit

Fix

Improper Authorization

Missing Authorization

Weakness Enumeration

CWE-285

CWE-862

Related Identifiers

CVE-2023-38508

GHSA-H637-G4XP-2992

Affected Products

Tuleap Community Edition

Tuleap Enterprise Edition

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38508.json · Exploit
• 🔥 https://tuleap.net/plugins/tracker/?aid=33608 · Exploit
• https://github.com/Enalean/tuleap/commit/307c1c8044522a2dcc711062b18a3b3f9059a6c3 · Patch
• https://github.com/Enalean/tuleap/security/advisories/GHSA-h637-g4xp-2992 · Vendor Advisory
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=307c1c8044522a2dcc711062b18a3b3f9059a6c3 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-38508 · Security Note
• https://osv.dev/vulnerability/CVE-2023-38508 · Vendor Advisory
• https://t.me/cibsecurity/69170 · Telegram Post