Vulnerability in Enalean Tuleap
CVE-2024-30246
Tuleap is an Open Source Suite to improve management of software developments and collaboration. A malicious user could exploit this issue on purpose to delete information on the instance or possibly gain access to restricted artifacts. It is however not possible to control exactly which information is deleted. Information from theDate, File, Float, Int, List, OpenList, Text, and Permissions on artifact (this one can lead to the disclosure of restricted information) fields can be impacted. This vulnerability is fixed in Tuleap Community Edition version 15.7.99.6 and Tuleap Enterprise Edition 15.7-2, 15.6-5, 15.5-6, 15.4-8, 15.3-6, 15.2-5, 15.1-9, 15.0-9, and 14.12-6.
EPSS: 0.006 (47.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L.
Affected products
- Enalean Tuleap — versions 15.7-1, >= 14.11.99.34, < 15.7.99.6
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Permissions Required, x_refsource_MISC)
- security-advisories@github.com (Third Party Advisory, x_refsource_MISC, Issue Tracking)
Frequently asked questions
- What is CVE-2024-30246?
- CVE-2024-30246 is a high-severity vulnerability in Enalean Tuleap, classified under Expected Behavior Violation. CVSS score: 7.6/10. Published 2024-03-29.
- How severe is CVE-2024-30246?
- High severity. CVSS v3 base score is 7.6 out of 10.
- Is CVE-2024-30246 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.