Unrated severityNVD Advisory· Published Oct 14, 2024· Updated Oct 15, 2024
Tuleap vulnerable to XSS in the HTML mail content of the cross reference field
CVE-2024-46980
Description
Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.37, Tuleap Enterprise Edition 15.13-3, and Tuleap Enterprise Edition 15.12-6, a site administrator could create an artifact link type with a forward label allowing them to execute uncontrolled code (or at least achieve content injection) in a mail client. Tuleap Community Edition 15.13.99.37, Tuleap Enterprise Edition 15.13-3, and Tuleap Enterprise Edition 15.12-6 fix this issue.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4- github.com/Enalean/tuleap/commit/dd94a799982cd78ab06142008d745edf9e8fd494mitrex_refsource_MISC
- github.com/Enalean/tuleap/security/advisories/GHSA-9fc9-47h6-82jjmitrex_refsource_CONFIRM
- tuleap.net/plugins/git/tuleap/tuleap/stablemitrex_refsource_MISC
- tuleap.net/plugins/tracker/mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.