Vulnerability in Enalean Tuleap
CVE-2024-39902
Tuleap is an open source suite to improve management of software developments and collaboration. Prior to Tuleap Community Edition 15.10.99.128 and Tuleap Enterprise Edition 15.10-6 and 15.9-8, the checkbox "Apply same permissions to all sub-items of this folder" in the document manager permissions modal is not taken into account and always considered as unchecked. In situations where the permissions are being restricted some users might still keep, incorrectly, the possibility to edit or manage items. Only change made via the web UI are affected, changes directly made via the REST API are not impacted. This vulnerability is fixed in Tuleap Community Edition 15.10.99.128 and Tuleap Enterprise Edition 15.10-6 and 15.9-8.
EPSS: 0.003 (23.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:H/A:N.
Affected products
- Enalean Tuleap — versions < 15.10.99.128
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC, Broken Link)
- security-advisories@github.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2024-39902?
- CVE-2024-39902 is a medium-severity vulnerability in Enalean Tuleap, classified under Improper Preservation of Permissions. CVSS score: 4.8/10. Published 2024-07-22.
- How severe is CVE-2024-39902?
- Medium severity. CVSS v3 base score is 4.8 out of 10.
- Is CVE-2024-39902 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.