PT-2024-28720 · Unknown · Tuleap Community Edition+1

Tgorka

+1

·

Published

2024-07-22

·

Updated

2025-04-10

·

CVE-2024-39902

CVSS v3.1

4.8

Medium

VectorAV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:N
Name of the Vulnerable Software and Affected Versions Tuleap Community Edition versions prior to 15.10.99.128 Tuleap Enterprise Edition versions prior to 15.10-6 and 15.9-8
Description The issue arises from the document manager permissions modal where the checkbox "Apply same permissions to all sub-items of this folder" is not taken into account and is always considered as unchecked. This can lead to some users incorrectly retaining the ability to edit or manage items when permissions are being restricted. The problem only affects changes made via the web UI, while changes directly made via the REST API are not impacted.
Recommendations For Tuleap Community Edition versions prior to 15.10.99.128, update to version 15.10.99.128 or later. For Tuleap Enterprise Edition versions prior to 15.10-6, update to version 15.10-6 or later. For Tuleap Enterprise Edition version 15.9, update to version 15.9-8 or later.

Exploit

Fix

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

CVE-2024-39902
GHSA-5JQ5-VXMQ-XRJ7

Affected Products

Tuleap Community Edition
Tuleap Enterprise Edition