PT-2024-32805 · Unknown · Tuleap Community Edition+1

Sandra Echinard + 1 · Published 2024-10-14 · Updated 2024-10-17 · CVE-2024-47767

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tuleap Community Edition versions prior to 15.13.99.113 Tuleap Enterprise Edition versions prior to 15.13-5 Tuleap Enterprise Edition versions prior to 15.12-8

Description Tuleap is a tool for end to end traceability of application and system developments. The issue allows users to see tracker names they should not have access to.

Recommendations For Tuleap Community Edition versions prior to 15.13.99.113, update to version 15.13.99.113 or later. For Tuleap Enterprise Edition versions prior to 15.13-5, update to version 15.13-5 or later. For Tuleap Enterprise Edition versions prior to 15.12-8, update to version 15.12-8 or later.

Exploit

Fix

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

CWE-280

Related Identifiers

CVE-2024-47767

GHSA-J342-V27Q-329V

Affected Products

Tuleap Community Edition

Tuleap Enterprise Edition

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47767.json · Exploit
• 🔥 https://github.com/Enalean/tuleap/security/advisories/GHSA-j342-v27q-329v · Exploit
• 🔥 https://tuleap.net/plugins/tracker/?aid=39728 · Exploit
• https://github.com/Enalean/tuleap/commit/f89d7093d2c576ad5e2b35a6a096fcdaf563d1df · Patch
• https://github.com/Enalean/tuleap/commit/e5ce81279766115dc0f126a11d6b5065b5db7eec · Patch
• https://github.com/Enalean/tuleap/commit/16d9efccb2fad8e10343be2604e94c9058ef2c89 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-47767 · Security Note
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=f89d7093d2c576ad5e2b35a6a096fcdaf563d1df · Patch
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=16d9efccb2fad8e10343be2604e94c9058ef2c89 · Patch
• https://osv.dev/vulnerability/CVE-2024-47767 · Vendor Advisory
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=e5ce81279766115dc0f126a11d6b5065b5db7eec · Patch
• https://twitter.com/CVEnew/status/1845892713813798942 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1846014599214047681 · Twitter Post
• https://t.me/cvedetector/7853 · Telegram Post