PT-2024-20770 · Unknown · Tuleap Community Edition+1

Atisne · Published 2024-02-22 · Updated 2025-02-05 · CVE-2024-25130

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tuleap Community Edition versions prior to 15.5.99.76 Tuleap Enterprise Edition versions prior to 15.5-4 Tuleap Enterprise Edition versions prior to 15.4-7

Description Tuleap is an open source suite to improve management of software developments and collaboration. Users with read access to a tracker where the mass update feature is used might get access to restricted information.

Recommendations For Tuleap Community Edition versions prior to 15.5.99.76, update to version 15.5.99.76 to resolve the issue. For Tuleap Enterprise Edition versions prior to 15.5-4, update to version 15.5-4 to resolve the issue. For Tuleap Enterprise Edition versions prior to 15.4-7, update to version 15.4-7 to resolve the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-25130

GHSA-MQ7F-M6MJ-HJJ5

Affected Products

Tuleap Community Edition

Tuleap Enterprise Edition

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/25xxx/CVE-2024-25130.json · Exploit
• https://github.com/Enalean/tuleap/security/advisories/GHSA-mq7f-m6mj-hjj5 · Vendor Advisory
• https://github.com/Enalean/tuleap/commit/57978a32508f5c6d0365419b6eaeb368aee20667 · Patch
• https://tuleap.net/plugins/tracker/?aid=36803 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-25130 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-25130 · Security Note
• https://twitter.com/CVEnew/status/1760735531837661397 · Twitter Post
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=57978a32508f5c6d0365419b6eaeb368aee20667 · Note
• https://t.me/cvenotify/110183 · Telegram Post