CVE-2022-46160

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Tuleap is an Open Source Suite to improve management of software developments and collaboration. In versions prior to 14.2.99.104, project level authorizations are not properly verified when accessing the project "homepage"/dashboards. Users not authorized to access a project may still be able to get some information provided by the widgets (e.g. number of members, content of the Notes widget...). This issue has been patched in Tuleap Community Edition 14.2.99.104, Tuleap Enterprise Edition 14.2-4, and Tuleap Enterprise Edition 14.1-5.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Dec 13, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-461619.8pdfmake is an open source client/server side PDF printing in pure JavaScript. In versions up to and including 0.2.5 pdfmake contains an unsa CVE-2022-461629.8discourse-bbcode is the official BBCode plugin for Discourse. Prior to commit 91478f5, CSS injection can occur when rendering content genera CVE-2022-461637.5Travel support program is a rails app to support the travel support program of openSUSE (TSP). Sensitive user data (bank account details, pa CVE-2022-461649.8NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io message handling a spe CVE-2022-461655.4Syncthing is an open source, continuous file synchronization program. In versions prior to 1.23.5 a compromised instance with shared folders CVE-2022-461669.8Spring boot admins is an open source administrative user interface for management of spring boot applications. All users who run Spring Boot CVE-2022-461678.8Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to version 0.1.3, a ServiceAccount deployed in a Tenant Namespac CVE-2022-461683.5Discourse is an option source discussion platform. Prior to version 2.8.14 on the `stable` branch and version 2.9.0.beta15 on the `beta` and CVE-2022-461699.8Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In CVE-2022-46176.1Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.3.2.CVE-2022-461709.8CodeIgniter is a PHP full-stack web framework. When an application uses (1) multiple session cookies (e.g., one for user pages and one for a CVE-2022-461717.7Tauri is a framework for building binaries for all major desktop platforms. The filesystem glob pattern wildcards `*`, `?`, and `[...]` matc