CVE-2023-35938

low-risk
Published 2023-06-29

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. When switching from a project visibility that allows restricted users to `Private without restricted`, restricted users that are project administrators keep this access right. Restricted users that were project administrators before the visibility switch keep the possibility to access the project and do some administration actions. This issue has been resolved in Tuleap version 14.9.99.63. Users are advised to upgrade. There are no known workarounds for this issue.

Do I need to act?

-
0.12% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.1/10 Medium
NETWORK / HIGH complexity

Affected Products (2)

Affected Vendors

Enalean

References (8)

Patch https://github.com/Enalean/tuleap/commit/a108186e7538676c4bf6e615f793f3b787a09b9...
Patch https://github.com/Enalean/tuleap/security/advisories/GHSA-rq42-cv6q-3m9q
Patch https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=a108186e7538676c4...
Issue Tracking https://tuleap.net/plugins/tracker/?aid=32278
Patch https://github.com/Enalean/tuleap/commit/a108186e7538676c4bf6e615f793f3b787a09b9...
Patch https://github.com/Enalean/tuleap/security/advisories/GHSA-rq42-cv6q-3m9q
Patch https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=a108186e7538676c4...
Issue Tracking https://tuleap.net/plugins/tracker/?aid=32278
22
/ 100
low-risk
Severity 14/34 · Moderate
Exploitability 1/34 · Minimal
Exposure 7/34 · Low