What’s Vulnerable › Vulnerabilities

CVE-2024-25130: Tuleap's mass update clears the permissions on artifact field

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-02-22 · updated 2026-06-17
• Weakness: CWE-200

Description

Tuleap is an open source suite to improve management of software developments and collaboration. Prior to version 15.5.99.76 of Tuleap Community Edition and prior to versions 15.5-4 and 15.4-7 of Tuleap Enterprise Edition, users with a read access to a tracker where the mass update feature is used might get access to restricted information. Tuleap Community Edition 15.5.99.76, Tuleap Enterprise Edition 15.5-4, and Tuleap Enterprise Edition 15.4-7 contain a patch for this issue.

Affected products

• Enalean tuleap: before 15.4-7; before 15.5.99.76; from 15.5 before 15.5-4 — fixed in 15.4-7, 15.5-4, 15.5.99.76

How to fix

Upgrade to a fixed version: Enalean tuleap 15.4-7, 15.5-4, 15.5.99.76. Check the vendor advisory for mitigations.

References

• https://github.com/Enalean/tuleap/commit/57978a32508f5c6d0365419b6eaeb368aee20667
• https://github.com/Enalean/tuleap/security/advisories/GHSA-mq7f-m6mj-hjj5
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=57978a32508f5c6d0365419b6eaeb368aee20667
• https://tuleap.net/plugins/tracker/?aid=36803
• https://github.com/Enalean/tuleap/commit/57978a32508f5c6d0365419b6eaeb368aee20667
• https://github.com/Enalean/tuleap/security/advisories/GHSA-mq7f-m6mj-hjj5
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=57978a32508f5c6d0365419b6eaeb368aee20667
• https://tuleap.net/plugins/tracker/?aid=36803

Get alerted when CVE-2024-25130 or the next vulnerability affects your stack