Marie Ange Garnier

**Name of the Vulnerable Software and Affected Versions** Tuleap versions prior to 16.4.99.1740498975 (Community Edition) Tuleap Enterprise Edition versions prior to 16.4-6 and 16.3-11 **Description** The issue has a limited impact in standard usage, mostly resulting in dangling data. However, a malicious user with access to one tracker could create and delete reports multiple times, cycling through all filters of all reports and deleting them, leading to the loss of all criteria filters. This would force users and tracker admins to re-create them. **Recommendations** For Tuleap Community Edition versions prior to 16.4.99.1740498975, update to version 16.4.99.1740498975 or later. For Tuleap Enterprise Edition versions prior to 16.4-6, update to version 16.4-6 or later. For Tuleap Enterprise Edition version 16.3, update to version 16.3-11 or later.

**Name of the Vulnerable Software and Affected Versions** Tuleap Community Edition versions 16.4.99.1739806825 through 16.4.99.1739877910 Tuleap Enterprise Edition versions prior to 16.3-9 Tuleap Enterprise Edition versions prior to 16.4-4 **Description** A malicious user with access to a tracker could force-reset certain field configurations, leading to potential information loss. The display time attribute for the `date` field, the size attribute for the `multiselectbox` field, the default value, number of rows, and columns attributes for the `text` field, and the default value, size, and max characters attributes for the `string` field configurations are lost when added as criteria in a saved report. This issue could be exploited to prevent access to tracker data by triggering a crash. **Recommendations** For Tuleap Community Edition versions 16.4.99.1739806825 through 16.4.99.1739877910, update to version 16.4.99.1739877910 or later. For Tuleap Enterprise Edition versions prior to 16.3-9, update to version 16.3-9 or later. For Tuleap Enterprise Edition versions prior to 16.4-4, update to version 16.4-4 or later. As a temporary workaround, consider restricting access to the tracker to minimize the risk of exploitation.