CVE-2025-24029

Katalog CVE

CVSS 5.3 · Medium EPSS 0,35%

Kerentanan Improper Handling of Insufficient Permissions or Privileges pada enalean tuleap. Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Users (possibly anonymous ones if the widget is used in the dashboard of a public project) might get access to artifacts they should not see. This issue has been addressed in Tuleap Community Edition 16.3.99.1737562605 as well as Tuleap Enterprise Edition 16.3-5 and Tuleap Enterprise Edition 16.2-7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Rincian

Terbit di NVD

3 Februari 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-280: Improper Handling of Insufficient Permissions or Privileges

EPSS (30 hari)

0,35% peluang dieksploitasi; lebih tinggi dari 26,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://tuleap.net/plugins/tracker/?aid=41476 issue tracking · patch · advisory vendor
• https://github.com/Enalean/tuleap/security/advisories/GHSA-hq46-63pc-xfv9 patch · advisory pihak ketiga
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=269cbaa73bac6d1c50674c48c9987263f2b38804 permissions required
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=a97480f951351c0f8f2f3f27f7daa3f7f9c37c75 permissions required