// For flags

CVE-2022-39233

Tuleap subject to Missing Authorization allowing for branch prefix modification

Severity Score

5.4
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions 12.9.99.228 and above, prior to 14.0.99.24, authorizations are not properly verified when updating the branch prefix used by the GitLab repository integration. Authenticated users can change the branch prefix of any of the GitLab repository integration they can see vie the REST endpoint `PATCH /gitlab_repositories/{id}`. This action should be restricted to Git administrators. This issue is patched in Tuleap Community Edition 14.0.99.24 and Tuleap Enterprise Edition 14.0-3. There are no known workarounds.

Tuleap es una suite libre y de código abierto para mejorar la administración de los desarrollos de software y la colaboración. En versiones 12.9.99.228 y superiores, anteriores a 14.0.99.24, las autorizaciones no son verificadas apropiadamente cuando es actualizado el prefijo de la rama usado por la integración del repositorio GitLab. Los usuarios autenticados pueden cambiar el prefijo de rama de cualquiera de las integraciones de repositorios de GitLab que pueden visualizar mediante el endpoint REST "PATCH /gitlab_repositories/{id}". Esta acción debería estar restringida a administradores de Git. Este problema está parcheado en Tuleap Community Edition versión 4.0.99.24 y Tuleap Enterprise Edition versión 14.0-3. No son conocidas mitigaciones

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-09-02 CVE Reserved
  • 2022-10-19 CVE Published
  • 2024-05-11 EPSS Updated
  • 2024-08-03 CVE Updated
  • 2024-08-03 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-862: Missing Authorization
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Enalean
Search vendor "Enalean"
 Tuleap
Search vendor "Enalean" for product "Tuleap"
 >= 12.9.99.228 < 14.0.99.24
Search vendor "Enalean" for product "Tuleap" and version " >= 12.9.99.228 < 14.0.99.24"
community
Affected
Enalean
Search vendor "Enalean"
 Tuleap
Search vendor "Enalean" for product "Tuleap"
 >= 12.10 < 13.12-6
Search vendor "Enalean" for product "Tuleap" and version " >= 12.10 < 13.12-6"
enterprise
Affected
Enalean
Search vendor "Enalean"
 Tuleap
Search vendor "Enalean" for product "Tuleap"
 >= 14.0 < 14.0-3
Search vendor "Enalean" for product "Tuleap" and version " >= 14.0 < 14.0-3"
enterprise
Affected