CVE-2022-31128: enalean tuleap

csirt@kutim:~/threat-intel/cve/CVE-2022-31128

CVSS 5.4 · Medium EPSS 0,65%

Kerentanan Missing Authorization pada enalean tuleap. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected versions Tuleap does not properly verify permissions when creating branches with the REST API in Git repositories using the fine grained permissions. Users can create branches via the REST endpoint `POST git/:id/branches` regardless of the permissions set on the repository. This issue has been fixed in version 13.10.99.82 Tuleap Community Edition as well as in version 13.10-3 of Tuleap Enterprise Edition. Users are advised to upgrade. There are no known workarounds for this issue.

Rincian

Terbit di NVD: 1 Agustus 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-862: Missing Authorization
EPSS (30 hari): 0,65% peluang dieksploitasi; lebih tinggi dari 49,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
enalean	tuleap	Versi 13.9.9.110 hingga sebelum 13.10.99.82
enalean	tuleap	Versi 13.10 hingga sebelum 13.10-3

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://tuleap.net/plugins/tracker/?aid=27538 issue tracking · patch · advisory vendor
https://github.com/Enalean/tuleap/commit/58ecb1dee1c46075d3e089980301ebfbe0bafd33 patch · advisory pihak ketiga
https://github.com/Enalean/tuleap/security/advisories/GHSA-2p49-vgcx-5w79 patch · advisory pihak ketiga
https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=58ecb1dee1c46075d3e089980301ebfbe0bafd33 patch · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.