CVE-2024-46988 Tuleap does not properly check permissions for email notifications in trackers
Attackers can receive email notifications containing sensitive information they are not authorized to access due to improper permission checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-46988?
CVE-2024-46988 is a medium-severity missing authorization vulnerability in Enalean Tuleap, published on 14 Oct 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.40, Tuleap Enterprise Edition 15.13-3, and Tuleap Enterprise Edition 15.12-6, users might receive email notification with information they should not have access to. Tuleap Community Edition 15.13.99.40, Tuleap Enterprise Edition 15.13-3, and Tuleap Enterprise Edition 15.12-6 fix this issue.
Which versions are affected by CVE-2024-46988?
It affects 1 product.
Products include Enalean Tuleap.
How do I fix CVE-2024-46988?
No fix has been published for CVE-2024-46988 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-46988 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-46988 exists.