VYPR
← All advisories
Medium severity5.4NVD Advisory· Published Jul 25, 2023· Updated Jun 17, 2026

CVE-2023-35929

CVE-2023-35929

Description

Tuleap is a free and open source suite to improve management of software development and collaboration. Prior to version 14.10.99.4 of Tuleap Community Edition and prior to versions 14.10-2 and 14.9-5 of Tuleap Enterprise Edition, content displayed in the "card fields" (visible in the kanban and PV2 apps) is not properly escaped. A malicious user with the capability to create an artifact or to edit a field used as a card field could force victim to execute uncontrolled code. Tuleap Community Edition 14.10.99.4, Tuleap Enterprise Edition 14.10-2, and Tuleap Enterprise Edition 14.9-5 contain a fix.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

6
  • Tuleap/Community Editionllm-fuzzy
    Range: <14.10.99.4
  • Tuleap/Enterprise Editionllm-fuzzy
    Range: <14.10-2, <14.9-5
  • Enalean/Tuleapllm-fuzzy4 versions
    (expand)+ 3 more
    • (no CPE)
    • cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*range: <14.9-5
    • cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:*range: <14.10.99.4
    • (no CPE)range: Tuleap Community Edition < 14.10.99.4

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.