XSS in Enalean Tuleap
CVE-2023-23938
Tuleap is a Free & Source tool for end to end traceability of application and system developments. Affected versions are subject to a cross site scripting attack which can be injected in the name of a color of select box values of a tracker and then reflected in the tracker administration. Administrative privilege is required, but an attacker with tracker administration rights could use this vulnerability to force a victim to execute uncontrolled code in the context of their browser. This issue has been addressed in Tuleap Community Edition version 14.5.99.4. Users are advised to upgrade. There are no known workarounds for this issue.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.005 (38.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L.
Affected products
- Enalean Tuleap — versions >= 13.8.99.4, < 14.5.99.4
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2023-23938?
- CVE-2023-23938 is a medium-severity vulnerability in Enalean Tuleap, classified under Cross-site Scripting. CVSS score: 5.9/10. Published 2023-04-20.
- How severe is CVE-2023-23938?
- Medium severity. CVSS v3 base score is 5.9 out of 10.
- Is CVE-2023-23938 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.