7.6

CVE-2024-30246

Tuleap is an Open Source Suite to improve management of software developments and collaboration. A malicious user could exploit this issue on purpose to delete information on the instance or possibly gain access to restricted artifacts. It is however not possible to control exactly which information is deleted. Information from theDate, File, Float, Int, List, OpenList, Text, and Permissions on artifact (this one can lead to the disclosure of restricted information) fields can be impacted.  This vulnerability is fixed in Tuleap Community Edition version 15.7.99.6 and Tuleap Enterprise Edition 15.7-2, 15.6-5, 15.5-6, 15.4-8, 15.3-6, 15.2-5, 15.1-9, 15.0-9, and 14.12-6.
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Enalean ≫ Tuleap SwEditioncommunity Version >= 14.11.99.34 < 15.7.99.6
Enalean ≫ Tuleap SwEditionenterprise Version >= 14.12-1 < 14.12-6
Enalean ≫ Tuleap SwEditionenterprise Version >= 15.0-1 < 15.0-9
Enalean ≫ Tuleap SwEditionenterprise Version >= 15.1-1 < 15.1-9
Enalean ≫ Tuleap SwEditionenterprise Version >= 15.2-1 < 15.2-5
Enalean ≫ Tuleap SwEditionenterprise Version >= 15.3-1 < 15.3-6
Enalean ≫ Tuleap SwEditionenterprise Version >= 15.4-1 < 15.4-8
Enalean ≫ Tuleap SwEditionenterprise Version >= 15.5-1 < 15.5-6
Enalean ≫ Tuleap SwEditionenterprise Version >= 15.6-1 < 15.6-5
Enalean ≫ Tuleap Version15.7-1 SwEditionenterprise
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.07% 0.208
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.1 2.8 4.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
security-advisories@github.com 7.6 2.8 4.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
CWE-440 Expected Behavior Violation

A feature, API, or function does not perform according to its specification.

CWE-670 Always-Incorrect Control Flow Implementation

The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.

https://tuleap.net/plugins/tracker/?aid=37545
Third Party Advisory
Issue Tracking