CVE-2022-24896

Tracker report renderer and chart widgets leak information in Tuleap

Medium4.3EPSS 0.80%

Published: 6 Jun 2022
Updated: 23 Apr 2025
Reserved: 10 Feb 2022
Assigned by: GitHub_M

Description

Tuleap is a Free & Open Source Suite to manage software developments and collaboration. In versions prior to 13.7.99.239 Tuleap does not properly verify authorizations when displaying the content of tracker report renderer and chart widgets. Malicious users could use this vulnerability to retrieve the name of a tracker they cannot access as well as the name of the fields used in reports.

Scores

CVSS scores of CVE-2022-24896, by who scored it
Scored by	CVSS	Score	Vector
GitHub_MCNA (assigner)	3.1	Medium4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVDNVD · Modified	3.1	Medium4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS (exploitation in 30 days): 0.80% · top 43% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.3.

Weakness

CWE-862: Missing Authorization (opens in a new tab)All about CWE-862 and its CVEs

Affected products

Enalean · tuleap
- affected < 13.7.99.239

References (4)

https://github.com/Enalean/tuleap/security/advisories/GHSA-x962-x43g-qw39 (opens in a new tab)x_refsource_CONFIRMx_transferred
https://github.com/Enalean/tuleap/commit/8e99e7c82d9fe569799019b9e1d614d38a184313 (opens in a new tab)x_refsource_MISCx_transferred
https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=8e99e7c82d9fe569799019b9e1d614d38a184313 (opens in a new tab)x_refsource_MISCx_transferred
https://tuleap.net/plugins/tracker/?aid=26729 (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2022-24896](https://trackcve.app/badge/CVE-2022-24896.svg)](https://trackcve.app/cve/CVE-2022-24896)

Record last updated 23 Apr 2025, 18:19 UTC.