CVE-2024-47766 Permissions are incorrectly verified for project administrators in the cross tracker search widget
Project administrators can bypass permission restrictions to read tracker content in other projects via the cross tracker search widget.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-47766?
CVE-2024-47766 is a medium-severity missing authorization vulnerability in Enalean Tuleap, published on 14 Oct 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.110, Tuleap Enterprise Edition 15.13-5, and Tuleap Enterprise Edition 15.12-5, administrators of a project can access the content of trackers with permissions restrictions of project they are members of but not admin via the cross tracker search widget. Tuleap Community Edition 15.13.99.110, Tuleap Enterprise Edition 15.13-5, and Tuleap Enterprise Edition 15.12-8 fix this issue.
Which versions are affected by CVE-2024-47766?
It affects 1 product.
Products include Enalean Tuleap.
How do I fix CVE-2024-47766?
No fix has been published for CVE-2024-47766 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-47766 being exploited?
There is no known exploitation of CVE-2024-47766 in the wild and no public exploit code.
Other vulnerabilities in Enalean Tuleap
Sources
Also known as GHSA-qfrh-fv84-93hx.