CVE-2023-48715CWE-79

Tuleap vulnerable to Cross-site Scripting on the edition page of a release

Medium · published December 11, 2023

CVSS v3.1
5.4
EPSS
1%
Percentile
43.2
In the wild
Unconfirmed
What it is

Tuleap is an open source suite to improve management of software developments and collaboration. Prior to version 15.2.99.103 of Tuleap Community Edition and prior to versions 15.2-4 and 15.1-8 of Tuleap Enterprise Edition, the name of the releases are not properly escaped on the edition page of a release. A malicious user with the ability to create a FRS release could force a victim having write permissions in the FRS to execute uncontrolled code. Tuleap Community Edition 15.2.99.103, Tuleap Enterprise Edition 15.2-4, and Tuleap Enterprise Edition 15.1-8 contain a fix for this issue.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00519 · 43.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2023-12-11T18:40Z
EPSS history
Timeline
  • 11 DEC 18:40Z
    Tuleap vulnerable to Cross-site Scripting on the edition page of a release
    cvelistv5