CVE-2024-47766

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-47766", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-09-30T21:28:53.231Z", "datePublished": "2024-10-14T17:53:55.763Z", "dateUpdated": "2024-10-15T15:37:35.456Z"}, "containers": {"cna": {"title": "Permissions are incorrectly verified for project administrators in the cross tracker search widget", "problemTypes": [{"descriptions": [{"cweId": "CWE-280", "lang": "en", "description": "CWE-280: Improper Handling of Insufficient Permissions or Privileges", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/Enalean/tuleap/security/advisories/GHSA-qfrh-fv84-93hx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Enalean/tuleap/security/advisories/GHSA-qfrh-fv84-93hx"}, {"name": "https://github.com/Enalean/tuleap/commit/529d11b70796589767dd27a40ebadf3eaf8f5674", "tags": ["x_refsource_MISC"], "url": "https://github.com/Enalean/tuleap/commit/529d11b70796589767dd27a40ebadf3eaf8f5674"}, {"name": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=529d11b70796589767dd27a40ebadf3eaf8f5674", "tags": ["x_refsource_MISC"], "url": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=529d11b70796589767dd27a40ebadf3eaf8f5674"}, {"name": "https://tuleap.net/plugins/tracker/?aid=39736", "tags": ["x_refsource_MISC"], "url": "https://tuleap.net/plugins/tracker/?aid=39736"}], "affected": [{"vendor": "Enalean", "product": "tuleap", "versions": [{"version": "< 15.13.99.110", "status": "affected"}, {"version": "< 15.13-5", "status": "affected"}, {"version": "< 15.12-8", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-10-14T17:56:18.186Z"}, "descriptions": [{"lang": "en", "value": "Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.110, Tuleap Enterprise Edition 15.13-5, and Tuleap Enterprise Edition 15.12-5, administrators of a project can access the content of trackers with permissions restrictions of project they are members of but not admin via the cross tracker search widget. Tuleap Community Edition 15.13.99.110, Tuleap Enterprise Edition 15.13-5, and Tuleap Enterprise Edition 15.12-8 fix this issue."}], "source": {"advisory": "GHSA-qfrh-fv84-93hx", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-15T15:37:27.168417Z", "id": "CVE-2024-47766", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-15T15:37:35.456Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Permissions are incorrectly verified for project administrators in the cross tracker search widget", "source": {"advisory": "GHSA-qfrh-fv84-93hx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Enalean", "product": "tuleap", "versions": [{"status": "affected", "version": "< 15.13.99.110"}, {"status": "affected", "version": "< 15.13-5"}, {"status": "affected", "version": "< 15.12-8"}]}], "references": [{"url": "https://github.com/Enalean/tuleap/security/advisories/GHSA-qfrh-fv84-93hx", "name": "https://github.com/Enalean/tuleap/security/advisories/GHSA-qfrh-fv84-93hx", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Enalean/tuleap/commit/529d11b70796589767dd27a40ebadf3eaf8f5674", "name": "https://github.com/Enalean/tuleap/commit/529d11b70796589767dd27a40ebadf3eaf8f5674", "tags": ["x_refsource_MISC"]}, {"url": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=529d11b70796589767dd27a40ebadf3eaf8f5674", "name": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=529d11b70796589767dd27a40ebadf3eaf8f5674", "tags": ["x_refsource_MISC"]}, {"url": "https://tuleap.net/plugins/tracker/?aid=39736", "name": "https://tuleap.net/plugins/tracker/?aid=39736", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.110, Tuleap Enterprise Edition 15.13-5, and Tuleap Enterprise Edition 15.12-5, administrators of a project can access the content of trackers with permissions restrictions of project they are members of but not admin via the cross tracker search widget. Tuleap Community Edition 15.13.99.110, Tuleap Enterprise Edition 15.13-5, and Tuleap Enterprise Edition 15.12-8 fix this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-280", "description": "CWE-280: Improper Handling of Insufficient Permissions or Privileges"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-10-14T17:56:18.186Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-47766", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-15T15:37:27.168417Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2024-10-15T15:37:31.629Z"}}]}, "cveMetadata": {"cveId": "CVE-2024-47766", "state": "PUBLISHED", "dateUpdated": "2024-10-14T17:56:18.186Z", "dateReserved": "2024-09-30T21:28:53.231Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-10-14T17:53:55.763Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "tuleap", "vendor": "Enalean", "versions": [{"status": "affected", "version": "< 15.13.99.110"}, {"status": "affected", "version": "< 15.13-5"}, {"status": "affected", "version": "< 15.12-8"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "7BB42325-937B-4940-9E68-983BA7A1BDD9", "versionEndExcluding": "15.12-8", "vulnerable": true}, {"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:*", "matchCriteriaId": "CBE37DC9-8561-48FE-BC75-5624DE2309EB", "versionEndExcluding": "15.13.99.110", "vulnerable": true}, {"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "49A386EB-18D7-4F4B-A8B9-C26C997C2CDF", "versionEndExcluding": "15.13-5", "versionStartIncluding": "15.13-0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.110, Tuleap Enterprise Edition 15.13-5, and Tuleap Enterprise Edition 15.12-5, administrators of a project can access the content of trackers with permissions restrictions of project they are members of but not admin via the cross tracker search widget. Tuleap Community Edition 15.13.99.110, Tuleap Enterprise Edition 15.13-5, and Tuleap Enterprise Edition 15.12-8 fix this issue."}, {"lang": "es", "value": "Tuleap es una herramienta para la trazabilidad de extremo a extremo de los desarrollos de aplicaciones y sistemas. Antes de Tuleap Community Edition 15.13.99.110, Tuleap Enterprise Edition 15.13-5 y Tuleap Enterprise Edition 15.12-5, los administradores de un proyecto pueden acceder al contenido de los rastreadores con restricciones de permisos del proyecto del que son miembros pero no administradores a trav\u00e9s del widget de b\u00fasqueda de rastreadores cruzados. Tuleap Community Edition 15.13.99.110, Tuleap Enterprise Edition 15.13-5 y Tuleap Enterprise Edition 15.12-8 solucionan este problema."}], "id": "CVE-2024-47766", "lastModified": "2026-06-17T07:57:42.980", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-47766", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-10-15T15:37:27.168417Z", "version": "2.0.3"}}]}, "published": "2024-10-14T18:15:04.387", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/Enalean/tuleap/commit/529d11b70796589767dd27a40ebadf3eaf8f5674"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://github.com/Enalean/tuleap/security/advisories/GHSA-qfrh-fv84-93hx"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=529d11b70796589767dd27a40ebadf3eaf8f5674"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://tuleap.net/plugins/tracker/?aid=39736"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-280"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-755"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}