CVE-2022-24896: Tracker report renderer and chart widgets leak information in Tuleap
First published: Mon Jun 06 2022(Updated: )
Tuleap is a Free & Open Source Suite to manage software developments and collaboration. In versions prior to 13.7.99.239 Tuleap does not properly verify authorizations when displaying the content of tracker report renderer and chart widgets. Malicious users could use this vulnerability to retrieve the name of a tracker they cannot access as well as the name of the fields used in reports.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Enalean Tuleap | <13.6-5 | |
| Enalean Tuleap | <13.7.99.239 | |
| Enalean Tuleap | >=13.7-1<13.7-4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/Enalean/tuleap/commit/8e99e7c82d9fe569799019b9e1d614d38a184313
- https://github.com/Enalean/tuleap/security/advisories/GHSA-x962-x43g-qw39
- https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=8e99e7c82d9fe569799019b9e1d614d38a184313
- https://tuleap.net/plugins/tracker/?aid=26729
Frequently Asked Questions
What is CVE-2022-24896?
CVE-2022-24896 is a vulnerability in Tuleap, a free and open-source suite for managing software development and collaboration. It allows malicious users to retrieve sensitive information.
What is the severity of CVE-2022-24896?
CVE-2022-24896 has a severity rating of 4.3, which is considered medium.
How does CVE-2022-24896 affect Tuleap?
CVE-2022-24896 affects Tuleap versions prior to 13.7.99.239. It allows unauthorized users to view content in tracker report renderer and chart widgets.
How can malicious users exploit CVE-2022-24896?
Malicious users can exploit CVE-2022-24896 to retrieve sensitive information by exploiting the vulnerability in Tuleap.
Is there a fix available for CVE-2022-24896?
Yes, a fix for CVE-2022-24896 is available in Tuleap version 13.7.99.239 and later.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/remedy
- agent/title
- agent/author
- agent/tags
- agent/first-publish-date
- agent/description
- agent/event
- vendor/enalean
- canonical/enalean tuleap
- version/enalean tuleap/13.7-1