CVE-2022-46160CWE-863

Tuleap dashboards vulnerable to Incorrect Authorization

Medium · published December 13, 2022

CVSS v3.1
4.3
EPSS
1%
Percentile
44.0
In the wild
Unconfirmed
What it is

Tuleap is an Open Source Suite to improve management of software developments and collaboration. In versions prior to 14.2.99.104, project level authorizations are not properly verified when accessing the project "homepage"/dashboards. Users not authorized to access a project may still be able to get some information provided by the widgets (e.g. number of members, content of the Notes widget...). This issue has been patched in Tuleap Community Edition 14.2.99.104, Tuleap Enterprise Edition 14.2-4, and Tuleap Enterprise Edition 14.1-5.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00531 · 44.0th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2022-12-13T06:40Z
EPSS history
Timeline
  • 13 DEC 06:40Z
    Tuleap dashboards vulnerable to Incorrect Authorization
    cvelistv5