CVE-2023-23938: Cross-site Scripting (XSS) through the name of a color of select box values in tuleap
First published: Thu Apr 20 2023(Updated: )
Tuleap is a Free & Source tool for end to end traceability of application and system developments. Affected versions are subject to a cross site scripting attack which can be injected in the name of a color of select box values of a tracker and then reflected in the tracker administration. Administrative privilege is required, but an attacker with tracker administration rights could use this vulnerability to force a victim to execute uncontrolled code in the context of their browser. This issue has been addressed in Tuleap Community Edition version 14.5.99.4. Users are advised to upgrade. There are no known workarounds for this issue.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Enalean Tuleap | <14.4-7 | |
| Enalean Tuleap | >=13.8.99.49<14.5.99.4 | |
| Enalean Tuleap | >=14.5<14.5-2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-23938?
CVE-2023-23938 is a vulnerability in Tuleap that allows for cross-site scripting attacks.
What is the severity of CVE-2023-23938?
The severity of CVE-2023-23938 is medium with a CVSS score of 4.8.
How does CVE-2023-23938 affect Tuleap?
CVE-2023-23938 affects certain versions of Tuleap, allowing for cross-site scripting attacks.
How can I fix CVE-2023-23938?
To fix CVE-2023-23938, it is recommended to update Tuleap to a patched version.
Where can I find more information about CVE-2023-23938?
You can find more information about CVE-2023-23938 on the Tuleap GitHub page and the Tuleap security advisories page.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/author
- agent/remedy
- agent/references
- agent/severity
- agent/title
- agent/tags
- agent/first-publish-date
- agent/event
- agent/description
- vendor/enalean
- canonical/enalean tuleap
- version/enalean tuleap/13.8.99.49
- version/enalean tuleap/14.5