CVE-2023-32072
29.05.2023, 21:15
Tuleap is an open source tool for end to end traceability of application and system developments. Tuleap Community Edition prior to version 14.8.99.60 and Tuleap Enterprise edition prior to 14.8-3 and 14.7-7, the logs of the triggered Jenkins job URLs are not properly escaped. A malicious Git administrator can setup a malicious Jenkins hook to make a victim, also a Git administrator, execute uncontrolled code. Tuleap Community Edition 14.8.99.60, Tuleap Enterprise Edition 14.8-3, and Tuleap Enterprise Edition 14.7-7 contain a patch for this issue.
| Vendor | Product | Version |
|---|---|---|
| enalean | tuleap | 𝑥 < 14.7-7 |
| enalean | tuleap | 𝑥 < 14.8.99.60 |
| enalean | tuleap | 14.8 ≤ 𝑥 < 14.8-3 |
𝑥
= Vulnerable software versions
References