CVE-2024-30246
Estado: AnalizadaAlta (7.1)—
Tuleap is an Open Source Suite to improve management of software developments and collaboration. A malicious user could exploit this issue on purpose to delete information on the instance or possibly gain access to restricted artifacts. It is however not possible to control exactly which information is deleted. Information from theDate, File, Float, Int, List, OpenList, Text, and Permissions on artifact (this one can lead to the disclosure of restricted information) fields can be impacted. This vulnerability is fixed in Tuleap Community Edition version 15.7.99.6 and Tuleap Enterprise Edition 15.7-2, 15.6-5, 15.5-6, 15.4-8, 15.3-6, 15.2-5, 15.1-9, 15.0-9, and 14.12-6.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
- Puntuación base: 7.1
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.62%
- Percentil entre todas las CVEs puntuadas: 48
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-440, CWE-670
- NVD-CWE-Other
Referencias
- https://github.com/Enalean/tuleap/commit/a0ba0ae82a29eb8bfacef286778e5e49954f5316
- https://github.com/Enalean/tuleap/security/advisories/GHSA-jc7g-4pcv-8jcj
- https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=a0ba0ae82a29eb8bfacef286778e5e49954f5316
- https://tuleap.net/plugins/tracker/?aid=37545
- https://github.com/Enalean/tuleap/commit/a0ba0ae82a29eb8bfacef286778e5e49954f5316
- https://github.com/Enalean/tuleap/security/advisories/GHSA-jc7g-4pcv-8jcj
- https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=a0ba0ae82a29eb8bfacef286778e5e49954f5316
- https://tuleap.net/plugins/tracker/?aid=37545
JSON original (NVD)
Mostrar
{
"id": "CVE-2024-30246",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-30246",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2024-08-21T14:00:19.062511Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "security-advisories@github.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.6,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "LOW",
"privilegesRequired": "LOW",
"confidentialityImpact": "LOW"
},
"impactScore": 4.7,
"exploitabilityScore": 2.8
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.1,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "LOW"
},
"impactScore": 4.2,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "security-advisories@github.com",
"affectedData": [
{
"vendor": "Enalean",
"product": "tuleap",
"versions": [
{
"status": "affected",
"version": ">= 14.11.99.34, < 15.7.99.6 "
}
]
}
]
}
],
"published": "2024-03-29T16:15:08.860",
"references": [
{
"url": "https://github.com/Enalean/tuleap/commit/a0ba0ae82a29eb8bfacef286778e5e49954f5316",
"tags": [
"Patch"
],
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/Enalean/tuleap/security/advisories/GHSA-jc7g-4pcv-8jcj",
"tags": [
"Third Party Advisory"
],
"source": "security-advisories@github.com"
},
{
"url": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=a0ba0ae82a29eb8bfacef286778e5e49954f5316",
"tags": [
"Permissions Required"
],
"source": "security-advisories@github.com"
},
{
"url": "https://tuleap.net/plugins/tracker/?aid=37545",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"source": "security-advisories@github.com"
},
{
"url": "https://github.com/Enalean/tuleap/commit/a0ba0ae82a29eb8bfacef286778e5e49954f5316",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://github.com/Enalean/tuleap/security/advisories/GHSA-jc7g-4pcv-8jcj",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=a0ba0ae82a29eb8bfacef286778e5e49954f5316",
"tags": [
"Permissions Required"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://tuleap.net/plugins/tracker/?aid=37545",
"tags": [
"Issue Tracking",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "security-advisories@github.com",
"description": [
{
"lang": "en",
"value": "CWE-440"
},
{
"lang": "en",
"value": "CWE-670"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Tuleap is an Open Source Suite to improve management of software developments and collaboration. A malicious user could exploit this issue on purpose to delete information on the instance or possibly gain access to restricted artifacts. It is however not possible to control exactly which information is deleted. Information from theDate, File, Float, Int, List, OpenList, Text, and Permissions on artifact (this one can lead to the disclosure of restricted information) fields can be impacted. This vulnerability is fixed in Tuleap Community Edition version 15.7.99.6 and Tuleap Enterprise Edition 15.7-2, 15.6-5, 15.5-6, 15.4-8, 15.3-6, 15.2-5, 15.1-9, 15.0-9, and 14.12-6."
},
{
"lang": "es",
"value": "Tuleap es una suite de código abierto para mejorar la gestión de los desarrollos de software y la colaboración. Un usuario malintencionado podría aprovechar este problema a propósito para eliminar información de la instancia o posiblemente obtener acceso a artefactos restringidos. Sin embargo, no es posible controlar exactamente qué información se elimina. La información de los campos Fecha, Archivo, Flotante, Int, Lista, Lista abierta, Texto y Permisos en artefactos (este puede conducir a la divulgación de información restringida) puede verse afectada. Esta vulnerabilidad se solucionó en Tuleap Community Edition versión 15.7.99.6 y Tuleap Enterprise Edition 15.7-2, 15.6-5, 15.5-6, 15.4-8, 15.3-6, 15.2-5, 15.1-9, 15.0-9 y 14.12. -6."
}
],
"lastModified": "2026-06-17T07:26:35.740",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7ABA9252-EF9D-4BD2-98DB-4FCF5B2037B7",
"versionEndExcluding": "15.7.99.6",
"versionStartIncluding": "14.11.99.34 "
},
{
"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ACE0DEB1-102A-44EE-8217-E1D489080FAF",
"versionEndExcluding": "14.12-6",
"versionStartIncluding": "14.12-1"
},
{
"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BB5542D6-16D4-407A-BCFC-32C96219F20E",
"versionEndExcluding": "15.0-9",
"versionStartIncluding": "15.0-1"
},
{
"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FA862976-6285-4A88-8D47-66AA341405EB",
"versionEndExcluding": "15.1-9",
"versionStartIncluding": "15.1-1"
},
{
"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2AE18296-FDFC-4A94-A245-35A98637A151",
"versionEndExcluding": "15.2-5",
"versionStartIncluding": "15.2-1"
},
{
"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AF0788F9-2729-418B-8761-843325A40FF7",
"versionEndExcluding": "15.3-6",
"versionStartIncluding": "15.3-1"
},
{
"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7AADD7EC-A8D9-4202-848C-AAA5B0F37CC5",
"versionEndExcluding": "15.4-8",
"versionStartIncluding": "15.4-1"
},
{
"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4BD949BE-FE7B-46F6-8E31-C4ACDF6EE508",
"versionEndExcluding": "15.5-6",
"versionStartIncluding": "15.5-1"
},
{
"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*",
"vulnerable": true,
"matchCriteriaId": "180691C4-B2E2-4387-9AB5-8A8678A984AE",
"versionEndExcluding": "15.6-5",
"versionStartIncluding": "15.6-1"
},
{
"criteria": "cpe:2.3:a:enalean:tuleap:15.7-1:*:*:*:enterprise:*:*:*",
"vulnerable": true,
"matchCriteriaId": "791E4104-6EB7-409D-9BF3-08D6AEFCFEEC"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "security-advisories@github.com"
}