CVE-2022-24896CWE-862

Tracker report renderer and chart widgets leak information in Tuleap

Medium · published June 6, 2022

CVSS v3.1
4.3
EPSS
1%
Percentile
55.5
In the wild
Unconfirmed
What it is

Tuleap is a Free & Open Source Suite to manage software developments and collaboration. In versions prior to 13.7.99.239 Tuleap does not properly verify authorizations when displaying the content of tracker report renderer and chart widgets. Malicious users could use this vulnerability to retrieve the name of a tracker they cannot access as well as the name of the fields used in reports.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00783 · 55.5th percentile
Weakness
CWE-862 · Missing Authorization
Published
2022-06-06T19:30Z
EPSS history
Timeline
  • 06 JUN 19:30Z
    Tracker report renderer and chart widgets leak information in Tuleap
    cvelistv5