CVE-2025-24029CWE-280

Artifact permissions are not verified in the Cross Tracker Search widget in Tuleap

Medium · published February 3, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
27.6
In the wild
Unconfirmed
What it is

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Users (possibly anonymous ones if the widget is used in the dashboard of a public project) might get access to artifacts they should not see. This issue has been addressed in Tuleap Community Edition 16.3.99.1737562605 as well as Tuleap Enterprise Edition 16.3-5 and Tuleap Enterprise Edition 16.2-7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00351 · 27.6th percentile
Weakness
CWE-280 · Improper Handling of Insufficient Permissions or Privileges
Published
2025-02-03T21:26Z
EPSS history
Timeline
  • 03 FEB 21:26Z
    Artifact permissions are not verified in the Cross Tracker Search widget in Tuleap
    cvelistv5