Skip to content
OpenAdvisories
Medium · 4.3 CVE-2022-24896 EUVD-2022-29660

Tracker report renderer and chart widgets leak information in Tuleap

Published Jun 6, 2022 · Updated Apr 23, 2025 · Assigned by GitHub_M

Description

Tuleap is a Free & Open Source Suite to manage software developments and collaboration. In versions prior to 13.7.99.239 Tuleap does not properly verify authorizations when displaying the content of tracker report renderer and chart widgets. Malicious users could use this vulnerability to retrieve the name of a tracker they cannot access as well as the name of the fields used in reports.

Affected products

VendorProductAffectedFixed
Enalean tuleap < 13.7.99.239 —

References