CVE-2023-35929

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-35929
Tuleap is a free and open source suite to improve management of software development and collaboration. Prior to version 14.10.99.4 of Tuleap Community Edition and prior to versions 14.10-2 and 14.9-5 of Tuleap Enterprise Edition, content displayed in the "card fields" (visible in the kanban and PV2 apps) is not properly escaped. A malicious user with the capability to create an artifact or to edit a field used as a card field could force victim to execute uncontrolled code. Tuleap Community Edition 14.10.99.4, Tuleap Enterprise Edition 14.10-2, and Tuleap Enterprise Edition 14.9-5 contain a fix.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/Enalean/tuleap/commit/0b2945fbd260d37aa0aff2ca1c867d160f76188d Patch
https://github.com/Enalean/tuleap/security/advisories/GHSA-xhjp-4rjf-q268 Vendor Advisory
https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=0b2945fbd260d37aa0aff2ca1c867d160f76188d Patch
https://tuleap.net/plugins/tracker/?aid=32629 Vendor Advisory
https://github.com/Enalean/tuleap/commit/0b2945fbd260d37aa0aff2ca1c867d160f76188d Patch
https://github.com/Enalean/tuleap/security/advisories/GHSA-xhjp-4rjf-q268 Vendor Advisory
https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=0b2945fbd260d37aa0aff2ca1c867d160f76188d Patch
https://tuleap.net/plugins/tracker/?aid=32629 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:*
cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*
History

21 Nov 2024, 08:08

Type Values Removed Values Added
References () https://github.com/Enalean/tuleap/commit/0b2945fbd260d37aa0aff2ca1c867d160f76188d - Patch () https://github.com/Enalean/tuleap/commit/0b2945fbd260d37aa0aff2ca1c867d160f76188d - Patch
References () https://github.com/Enalean/tuleap/security/advisories/GHSA-xhjp-4rjf-q268 - Vendor Advisory () https://github.com/Enalean/tuleap/security/advisories/GHSA-xhjp-4rjf-q268 - Vendor Advisory
References () https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=0b2945fbd260d37aa0aff2ca1c867d160f76188d - Patch () https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=0b2945fbd260d37aa0aff2ca1c867d160f76188d - Patch
References () https://tuleap.net/plugins/tracker/?aid=32629 - Vendor Advisory () https://tuleap.net/plugins/tracker/?aid=32629 - Vendor Advisory

02 Aug 2023, 18:54

Type Values Removed Values Added
References (MISC) https://github.com/Enalean/tuleap/commit/0b2945fbd260d37aa0aff2ca1c867d160f76188d - (MISC) https://github.com/Enalean/tuleap/commit/0b2945fbd260d37aa0aff2ca1c867d160f76188d - Patch
References (MISC) https://github.com/Enalean/tuleap/security/advisories/GHSA-xhjp-4rjf-q268 - (MISC) https://github.com/Enalean/tuleap/security/advisories/GHSA-xhjp-4rjf-q268 - Vendor Advisory
References (MISC) https://tuleap.net/plugins/tracker/?aid=32629 - (MISC) https://tuleap.net/plugins/tracker/?aid=32629 - Vendor Advisory
References (MISC) https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=0b2945fbd260d37aa0aff2ca1c867d160f76188d - (MISC) https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=0b2945fbd260d37aa0aff2ca1c867d160f76188d - Patch
CPE cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.4
First Time Enalean
Enalean tuleap

25 Jul 2023, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-07-25 18:15

Updated : 2024-11-21 08:08

NVD link : CVE-2023-35929

Mitre link : CVE-2023-35929

CVE.ORG link : CVE-2023-35929

JSON object : View

Products Affected

enalean

  • tuleap
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')