Vulnerability Details : CVE-2022-31032
Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.58 authorizations are not properly verified when creating projects or trackers from projects marked as templates. Users can get access to information in those template projects because the permissions model is not properly enforced. Users are advised to upgrade. There are no known workarounds for this issue.
Vulnerability category: Information leak
Products affected by CVE-2022-31032
- cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*
- cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:*
- cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-31032
0.09%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 38 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-31032
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.0
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:N/A:N |
8.0
|
2.9
|
NIST | |
|
4.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
2.8
|
1.4
|
NIST | |
|
4.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
2.8
|
1.4
|
GitHub, Inc. |
CWE ids for CVE-2022-31032
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: security-advisories@github.com (Secondary)
-
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.Assigned by: nvd@nist.gov (Primary)
References for CVE-2022-31032
-
https://tuleap.net/plugins/tracker/?aid=26816
Resources of private projects can be accessed by non project mem - request #26816 - Requests - TuleapIssue Tracking;Vendor Advisory
-
https://docs.tuleap.org/administration-guide/users-management/security/site-access.html
Permissions model — Tuleap latest version documentationProduct
-
https://github.com/Enalean/tuleap/commit/cc38bcc59ce0c733ca915d95daec5f3082fb17ca
Merge commit 'refs/changes/79/25979/8' of ssh://gerrit.tuleap.net:294… · Enalean/tuleap@cc38bcc · GitHubPatch;Third Party Advisory
-
https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=7e221a9d1893c13407b35008762757a76d8e5654
Git - TuleapPatch;Vendor Advisory
-
https://github.com/Enalean/tuleap/commit/7e221a9d1893c13407b35008762757a76d8e5654
request #26816 Resources of private projects can be accessed by non p… · Enalean/tuleap@7e221a9 · GitHubPatch;Third Party Advisory
-
https://github.com/Enalean/tuleap/security/advisories/GHSA-hvx6-4228-whj3
Resources of private projects can be accessed by non project members · Advisory · Enalean/tuleap · GitHubThird Party Advisory
Jump to