PT-2024-35395 · Unknown · Tuleap Community Edition+1

Nicolas Terray + 1 · Published 2024-12-09 · Updated 2024-12-09 · CVE-2024-52599

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Tuleap Community Edition versions prior to 16.1.99.50 Tuleap Enterprise Edition versions prior to 16.1-4 Tuleap Enterprise Edition versions prior to 16.0-7

Description A malicious user with the ability to create an artifact in a tracker with a Gantt chart could force a victim to execute uncontrolled code.

Recommendations For Tuleap Community Edition versions prior to 16.1.99.50, update to version 16.1.99.50 or later. For Tuleap Enterprise Edition versions prior to 16.1-4, update to version 16.1-4 or later. For Tuleap Enterprise Edition versions prior to 16.0-7, update to version 16.0-7 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-52599

GHSA-489C-FM2J-QJW7

Affected Products

Tuleap Community Edition

Tuleap Enterprise Edition

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52599.json · Exploit
• 🔥 https://tuleap.net/plugins/tracker/?aid=40459 · Exploit
• https://github.com/Enalean/tuleap/commit/d3686ab152b6f64ff835e7dd3c99d97b36a9d4d5 · Patch
• https://github.com/Enalean/tuleap/security/advisories/GHSA-489c-fm2j-qjw7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-52599 · Security Note
• https://osv.dev/vulnerability/CVE-2024-52599 · Vendor Advisory
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=d3686ab152b6f64ff835e7dd3c99d97b36a9d4d5 · Note
• https://twitter.com/CVEnew/status/1866202700880523461 · Twitter Post
• https://t.me/cvedetector/12443 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1866256541029916678 · Twitter Post