CVE-2022-46160: enalean tuleap

csirt@kutim:~/threat-intel/cve/CVE-2022-46160

CVSS 4.3 · Medium EPSS 0,53%

Kerentanan Incorrect Authorization pada enalean tuleap. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

Tuleap is an Open Source Suite to improve management of software developments and collaboration. In versions prior to 14.2.99.104, project level authorizations are not properly verified when accessing the project "homepage"/dashboards. Users not authorized to access a project may still be able to get some information provided by the widgets (e.g. number of members, content of the Notes widget...). This issue has been patched in Tuleap Community Edition 14.2.99.104, Tuleap Enterprise Edition 14.2-4, and Tuleap Enterprise Edition 14.1-5.

Rincian

Terbit di NVD: 13 Desember 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-863: Incorrect Authorization
EPSS (30 hari): 0,53% peluang dieksploitasi; lebih tinggi dari 43,3% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
enalean	tuleap	Semua versi sebelum 14.1-5
enalean	tuleap	Semua versi sebelum 14.2.99.104
enalean	tuleap	Versi 14.2-1 hingga sebelum 14.2-4

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=0910a7b0ce14763e5c388be6ca4bcfd1c675c5d8 patch · advisory vendor
https://tuleap.net/plugins/tracker/?aid=29642 issue tracking · patch · advisory vendor
https://github.com/Enalean/tuleap/security/advisories/GHSA-hjhc-xqjh-9fv3 patch · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.