PT-2024-27351 · Unknown · Tuleap Community Edition

Tgerbet + 1 · Published 2024-06-25 · Updated 2025-08-22 · CVE-2024-37167

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tuleap Community Edition versions prior to 15.9.99.97

Description The issue allows users to see backlog items that they should not have access to. This is a problem related to the management of software developments and collaboration within the Tuleap Open Source Suite.

Recommendations For versions prior to 15.9.99.97, update to Tuleap Community Edition version 15.9.99.97 to resolve the issue.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2024-37167

GHSA-4C9F-284J-PHVJ

Affected Products

Tuleap Community Edition

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37167.json · Exploit
• https://github.com/Enalean/tuleap/security/advisories/GHSA-4c9f-284j-phvj · Vendor Advisory
• https://github.com/Enalean/tuleap/commit/13eec93a353d2daf47bb8b9c548cc02f78b93a5e · Patch
• https://osv.dev/vulnerability/CVE-2024-37167 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37167 · Security Note
• https://tuleap.net/plugins/tracker/?aid=38297 · Vendor Advisory
• https://t.me/cvenotify/84387 · Telegram Post
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=13eec93a353d2daf47bb8b9c548cc02f78b93a5e · Note
• https://t.me/cvenotify/84466 · Telegram Post
• https://t.me/cveNotify/133184 · Telegram Post