CVE-2022-31032
Resources of private projects can be exposed in Tuleap
- State
- Published
- Severity
- 4.3 Medium
- Published
- Jun 29, 2022
- Updated
- Apr 23, 2025
- Reserved
- May 18, 2022
Description
Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.58 authorizations are not properly verified when creating projects or trackers from projects marked as templates. Users can get access to information in those template projects because the permissions model is not properly enforced. Users are advised to upgrade. There are no known workarounds for this issue.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | GitHub_M |
Weaknesses
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected Products
| Product | Versions |
|---|---|
tuleapEnalean |
|
References
- https://github.com/Enalean/tuleap/security/advisories/GHSA-hvx6-4228-whj3
- https://github.com/Enalean/tuleap/commit/7e221a9d1893c13407b35008762757a76d8e5654
- https://github.com/Enalean/tuleap/commit/cc38bcc59ce0c733ca915d95daec5f3082fb17ca
- https://docs.tuleap.org/administration-guide/users-management/security/site-access.html
- https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=7e221a9d1893c13407b35008762757a76d8e5654
- https://tuleap.net/plugins/tracker/?aid=26816
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.