CVE-2025-22129: falha de média gravidade em Enalean tuleap
Initial effort field does not respect field permissions in the Taskboard REST card representation in Tuleap
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.3epss 0.3%
Tuleap is an Open Source Suite to improve management of software developments and collaboration. In affected versions an unauthorized user might get access to restricted information. This issue has been addressed in Tuleap Community Edition 16.3.99.1736242932, Tuleap Enterprise Edition 16.2-5, and Tuleap Enterprise Edition 16.3-2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
Enalean · tuleapCVEs relacionadas — Enalean tuleap
No mesmo produto, das mais perigosas para as menos.
CVE-2021-41147HIGHSQL injection in the planning edition panelEPSS 1.9%CVE-2021-43806HIGHSQL injection in TuleapEPSS 1.6%CVE-2021-41276MEDIUMIndirect LDAP injection in TuleapEPSS 1.5%CVE-2021-41154HIGHSQL injection in the "SVN core" commits browserEPSS 1.5%CVE-2021-41155HIGHSQL injection in CVS revisions browserEPSS 1.5%CVE-2021-41148HIGHThe update of the CI job targeted by a widget is vulnerable to blind SQL injectionsEPSS 1.5%