CVE-2024-25130

low-risk
Published 2024-02-22

Tuleap is an open source suite to improve management of software developments and collaboration. Prior to version 15.5.99.76 of Tuleap Community Edition and prior to versions 15.5-4 and 15.4-7 of Tuleap Enterprise Edition, users with a read access to a tracker where the mass update feature is used might get access to restricted information. Tuleap Community Edition 15.5.99.76, Tuleap Enterprise Edition 15.5-4, and Tuleap Enterprise Edition 15.4-7 contain a patch for this issue.

Do I need to act?

-
0.19% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.4/10 Medium
NETWORK / HIGH complexity

Affected Products (2)

Affected Vendors

Enalean

References (8)

Patch https://github.com/Enalean/tuleap/commit/57978a32508f5c6d0365419b6eaeb368aee2066...
Patch https://github.com/Enalean/tuleap/security/advisories/GHSA-mq7f-m6mj-hjj5
Broken Link https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=57978a32508f5c6d0...
Vendor Advisory https://tuleap.net/plugins/tracker/?aid=36803
Patch https://github.com/Enalean/tuleap/commit/57978a32508f5c6d0365419b6eaeb368aee2066...
Patch https://github.com/Enalean/tuleap/security/advisories/GHSA-mq7f-m6mj-hjj5
Broken Link https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=57978a32508f5c6d0...
Vendor Advisory https://tuleap.net/plugins/tracker/?aid=36803
25
/ 100
low-risk
Severity 17/34 · Moderate
Exploitability 1/34 · Minimal
Exposure 7/34 · Low