« Volver al listado

CVE-2024-52599

Estado: AnalizadaMedia (5.4)—

Tuleap is an open source suite to improve management of software developments and collaboration. In Tuleap Community Edition prior to version 16.1.99.50 and Tuleap Enterprise Edition prior to versions 16.1-4 and 16.0-7, a malicious user with the ability to create an artifact in a tracker with a Gantt chart could force a victim to execute uncontrolled code. Tuleap Community Edition 16.1.99.50, Tuleap Enterprise Edition 16.1-4, and Tuleap Enterprise Edition 16.0-7 contain a fix.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Enalean — Tuleap

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-52599",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-52599",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-10T16:17:26.941524Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "Enalean",
          "product": "tuleap",
          "versions": [
            {
              "status": "affected",
              "version": "< 16.1.99.50"
            },
            {
              "status": "affected",
              "version": "< 16.1-4"
            },
            {
              "status": "affected",
              "version": "< 16.0-7"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-12-09T19:15:13.863",
  "references": [
    {
      "url": "https://github.com/Enalean/tuleap/commit/d3686ab152b6f64ff835e7dd3c99d97b36a9d4d5",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Enalean/tuleap/security/advisories/GHSA-489c-fm2j-qjw7",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=d3686ab152b6f64ff835e7dd3c99d97b36a9d4d5",
      "tags": [
        "Permissions Required"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://tuleap.net/plugins/tracker/?aid=40459",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Tuleap is an open source suite to improve management of software developments and collaboration. In Tuleap Community Edition prior to version 16.1.99.50 and Tuleap Enterprise Edition prior to versions 16.1-4 and 16.0-7, a malicious user with the ability to create an artifact in a tracker with a Gantt chart could force a victim to execute uncontrolled code. Tuleap Community Edition 16.1.99.50, Tuleap Enterprise Edition 16.1-4, and Tuleap Enterprise Edition 16.0-7 contain a fix."
    },
    {
      "lang": "es",
      "value": "Tuleap es una suite de código abierto para mejorar la gestión de los desarrollos de software y la colaboración. En Tuleap Community Edition anterior a la versión 16.1.99.50 y Tuleap Enterprise Edition anterior a las versiones 16.1-4 y 16.0-7, un usuario malintencionado con la capacidad de crear un artefacto en un rastreador con un diagrama de Gantt podría obligar a una víctima a ejecutar código no controlado. Tuleap Community Edition 16.1.99.50, Tuleap Enterprise Edition 16.1-4 y Tuleap Enterprise Edition 16.0-7 contienen una corrección."
    }
  ],
  "lastModified": "2026-06-17T08:07:31.573",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F6A1C564-201D-43CA-BD24-E7DE7B2F8C2E",
              "versionEndExcluding": "16.0-7"
            },
            {
              "criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D6B1E987-E529-41F7-AE4E-83EEA8C7240B",
              "versionEndExcluding": "16.1.99.50"
            },
            {
              "criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0163CCD1-23B5-4295-A36C-5621C4CA5C3B",
              "versionEndExcluding": "16.1-4",
              "versionStartIncluding": "16.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}