CVE-2024-52599CWE-79

Tuleap vulnerable to XSS in the Gantt chart of the tracker plugin

Medium · published December 9, 2024

CVSS v3.1
5.4
EPSS
0%
Percentile
23.9
In the wild
Unconfirmed
What it is

Tuleap is an open source suite to improve management of software developments and collaboration. In Tuleap Community Edition prior to version 16.1.99.50 and Tuleap Enterprise Edition prior to versions 16.1-4 and 16.0-7, a malicious user with the ability to create an artifact in a tracker with a Gantt chart could force a victim to execute uncontrolled code. Tuleap Community Edition 16.1.99.50, Tuleap Enterprise Edition 16.1-4, and Tuleap Enterprise Edition 16.0-7 contain a fix.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00321 · 23.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-12-09T18:41Z
EPSS history
Timeline
  • 09 DEC 18:41Z
    Tuleap vulnerable to XSS in the Gantt chart of the tracker plugin
    cvelistv5