CVE-2023-35938 json
User access not updated with privilege change in Tuleap
published 2023-06-29 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-39922
- cvss
- 4.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 48%
- public exploits
- 0
- none known
Summary
Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. When switching from a project visibility that allows restricted users to `Private without restricted`, restricted users that are project administrators keep this access right. Restricted users that were project administrators before the visibility switch keep the possibility to access the project and do some administration actions. This issue has been resolved in Tuleap version 14.9.99.63. Users are advised to upgrade. There are no known workarounds for this issue.
Patch / fix
- enalean tuleap 14.9.99.63, 14.10-1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.59% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.1 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L |
| NVD | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Enalean tuleap
Classification
- Weakness
-
- CWE-281 Improper Preservation of Permissions
References
-
github.com
/Enalean/tuleap/commit/a108186e7538676c4bf6e615f793f3b787a09b91
patch
-
tuleap.net
/plugins/git/tuleap/tuleap/stable?a=commit&h=a108186e7538676c4bf6e615f793f3b787a09b91
patch
-
github.com
/Enalean/tuleap/security/advisories/GHSA-rq42-cv6q-3m9q
patch, vendor-advisory
-
tuleap.net
/plugins/tracker/?aid=32278
issue-tracking, vendor-advisory
Sources
- CVE List CVE-2023-35938
- NVD CVE-2023-35938
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.