CVE-2022-31063

Cross site scripting via the title of a document in Tuleap

Severity Score

5.4

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.111 the title of a document is not properly escaped in the search result of MyDocmanSearch widget and in the administration page of the locked documents. A malicious user with the capability to create a document could force victim to execute uncontrolled code. Users are advised to upgrade. There are no known workarounds for this issue.

Tuleap es una suite libre y de código abierto para mejorar la administración de los desarrollos de software y la colaboración. En versiones anteriores a 13.9.99.111, el título de un documento no se escapa apropiadamente en el resultado de la búsqueda del widget MyDocmanSearch y en la página de administración de los documentos bloqueados. Un usuario malicioso con capacidad para crear un documento podría forzar a la víctima a ejecutar código no controlado. Es recomendado a usuarios actualizar. No se presentan mitigaciones conocidas para este problema

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Attack Vector

Network

Attack Complexity

Medium

Authentication

Single

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-05-18 CVE Reserved
2022-06-29 CVE Published
2024-01-20 EPSS Updated
2024-08-03 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CAPEC

References (4)

URL	Tag	Source
https://github.com/Enalean/tuleap/security/advisories/GHSA-4fx8-4ff3-96jf	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
https://github.com/Enalean/tuleap/commit/c947975a4f1ff7bbfd7d5cd24a2e16bf12bd96d4	2022-07-15
https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=c947975a4f1ff7bbfd7d5cd24a2e16bf12bd96d4	2022-07-15

URL	Date	SRC
https://tuleap.net/plugins/tracker/?aid=27173	2022-07-15

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Enalean Search vendor "Enalean"		Tuleap Search vendor "Enalean" for product "Tuleap"				< 13.9.99.111 Search vendor "Enalean" for product "Tuleap" and version " < 13.9.99.111"		community		Affected
Enalean Search vendor "Enalean"		Tuleap Search vendor "Enalean" for product "Tuleap"				>= 13.8.0 < 13.8.6 Search vendor "Enalean" for product "Tuleap" and version " >= 13.8.0 < 13.8.6"		enterprise		Affected
Enalean Search vendor "Enalean"		Tuleap Search vendor "Enalean" for product "Tuleap"				>= 13.9.0 < 13.9.3 Search vendor "Enalean" for product "Tuleap" and version " >= 13.9.0 < 13.9.3"		enterprise		Affected