CVE-2023-38508

Name of the Vulnerable Software and Affected Versions Tuleap Community Edition versions prior to 14.11.99.28 Tuleap Enterprise Edition versions prior to 14.10-6 Tuleap Enterprise Edition versions prior to 14.11-3

Description The preview of an artifact link with a type in Tuleap does not respect project, tracker, and artifact level permissions. This issue occurs on the artifact view and allows users to access information they should not have access to, including the title, status, assigned to, and last update date fields. However, strict permissions on these fields are still enforced.

Recommendations For Tuleap Community Edition versions prior to 14.11.99.28, update to version 14.11.99.28 or later. For Tuleap Enterprise Edition versions prior to 14.10-6, update to version 14.10-6 or later. For Tuleap Enterprise Edition versions prior to 14.11-3, update to version 14.11-3 or later.