4.8

CVE-2024-46980

Exploit

Tuleap vulnerable to XSS in the HTML mail content of the cross reference field

Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.37, Tuleap Enterprise Edition 15.13-3, and Tuleap Enterprise Edition 15.12-6, a site administrator could create an artifact link type with a forward label allowing them to execute uncontrolled code (or at least achieve content injection) in a mail client. Tuleap Community Edition 15.13.99.37, Tuleap Enterprise Edition 15.13-3, and Tuleap Enterprise Edition 15.12-6 fix this issue.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Enalean ≫ Tuleap SwEditionenterprise Version < 15.12-6
Enalean ≫ Tuleap SwEditioncommunity Version < 15.13.99.37
Enalean ≫ Tuleap SwEditionenterprise Version >= 15.13-0 < 15.13-3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.35% 0.263
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.8 1.7 2.7
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
security-advisories@github.com 4.8 1.7 2.7
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:L
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://github.com/Enalean/tuleap/commit/dd94a799982cd78ab06142008d745edf9e8fd494
Patch
https://github.com/Enalean/tuleap/security/advisories/GHSA-9fc9-47h6-82jj
Third Party Advisory
https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=dd94a799982cd78ab06142008d745edf9e8fd494
Patch
Issue Tracking
https://tuleap.net/plugins/tracker/?aid=39689
Third Party Advisory
Exploit