CVE-2023-35938: enalean tuleap

csirt@kutim:~/threat-intel/cve/CVE-2023-35938

CVSS 7.2 · High EPSS 0,59%

Kerentanan Improper Preservation of Permissions pada enalean tuleap. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. When switching from a project visibility that allows restricted users to `Private without restricted`, restricted users that are project administrators keep this access right. Restricted users that were project administrators before the visibility switch keep the possibility to access the project and do some administration actions. This issue has been resolved in Tuleap version 14.9.99.63. Users are advised to upgrade. There are no known workarounds for this issue.

Rincian

Terbit di NVD: 29 Juni 2023
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-281: Improper Preservation of Permissions
EPSS (30 hari): 0,59% peluang dieksploitasi; lebih tinggi dari 46,8% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
enalean	tuleap	Semua versi sebelum 14.9.99.63
enalean	tuleap	Semua versi sebelum 14.10-1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/Enalean/tuleap/security/advisories/GHSA-rq42-cv6q-3m9q patch · advisory vendor
https://tuleap.net/plugins/tracker/?aid=32278 issue tracking · advisory vendor
https://github.com/Enalean/tuleap/commit/a108186e7538676c4bf6e615f793f3b787a09b91 patch
https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=a108186e7538676c4bf6e615f793f3b787a09b91 patch

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.