CVE-2024-47766

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.110, Tuleap Enterprise Edition 15.13-5, and Tuleap Enterprise Edition 15.12-5, administrators of a project can access the content of trackers with permissions restrictions of project they are members of but not admin via the cross tracker search widget. Tuleap Community Edition 15.13.99.110, Tuleap Enterprise Edition 15.13-5, and Tuleap Enterprise Edition 15.12-8 fix this issue.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-280 CWE-755

Affected software

No affected versions have been published.

Timeline

Published: Oct 14, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-477674.3Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.113, Tuleap CVE-2024-477688.1Lif Authentication Server is a server used by Lif to do various tasks regarding Lif accounts. This vulnerability has to do with the account CVE-2024-477697.5IDURAR is open source ERP CRM accounting invoicing software. The vulnerability exists in the corePublicRouter.js file. Using the reference u CVE-2024-47778.8Memory safety bugs present in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10. Some of these bugs showed evidence of memory corrupti CVE-2024-477708.0Wazuh is a free and open source platform used for threat prevention, detection, and response. It is capable of protecting workloads across o CVE-2024-477717.0Element Desktop is a Matrix client for desktop platforms. Element Desktop versions 1.11.70 through 1.11.80 contain a vulnerability which can CVE-2024-477726.1Discourse is an open source platform for community discussion. An attacker can execute arbitrary JavaScript on users' browsers by sending a CVE-2024-477738.2Discourse is an open source platform for community discussion. An attacker can make several XHR requests until the cache is poisoned with a CVE-2024-477749.1GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been identified in the gst_avi_su CVE-2024-477759.1GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been found in the parse_ds64 func CVE-2024-477769.1GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been discovered in gst_wavparse_cue_chunk withi CVE-2024-477779.1GStreamer is a library for constructing graphs of media-handling components. An OOB-read vulnerability has been identified in the gst_wavpar