CVE-2023-39521: Tuleap vulnerable to Cross-site Scripting on the success message of a kanban deletion
Tuleap is an open source suite to improve management of software developments and collaboration. In Tuleap Community Edition prior to version 14.11.99.28 and Tuleap Enterprise Edition prior to versions 14.10-6 and 14.11-3, content displayed in the "card fields" (visible in the kanban and PV2 apps) is not properly escaped. An agile dashboard administrator deleting a kanban with a malicious label can be forced to execute uncontrolled code. Tuleap Community Edition 14.11.99.28, Tuleap Enterprise Edition 14.10-6, and Tuleap Enterprise Edition 14.11-3 contain a fix for this issue.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-39521?
CVE-2023-39521 is a vulnerability in Tuleap Community Edition prior to version 14.11.99.28 and Tuleap Enterprise Edition prior to versions 14.10-6 and 14.11-3 that allows for content displayed in the "card fields" to be manipulated.
What is the severity of CVE-2023-39521?
The severity of CVE-2023-39521 is medium, with a severity value of 4.8.
What software is affected by CVE-2023-39521?
The Tuleap Community Edition versions up to 14.11.99.28 and Tuleap Enterprise Edition versions 14.10-6 to 14.10-7 and 14.11-3 to 14.11-5 are affected by CVE-2023-39521.
How can CVE-2023-39521 be fixed?
To fix CVE-2023-39521, users are advised to update their Tuleap installations to Tuleap Community Edition version 14.11.99.28 or higher, or Tuleap Enterprise Edition versions 14.10-7 or 14.11-5.
What is CWE-79?
CWE-79 is a common weakness enumeration that refers to the vulnerability known as Cross-Site Scripting (XSS).