CVE-2022-24896 - CVE House
Back to Database
Status published Medium CVE-2022-24896

Tracker report renderer and chart widgets leak information in Tuleap

Vulnerability Description

Tuleap is a Free & Open Source Suite to manage software developments and collaboration. In versions prior to 13.7.99.239 Tuleap does not properly verify authorizations when displaying the content of tracker report renderer and chart widgets. Malicious users could use this vulnerability to retrieve the name of a tracker they cannot access as well as the name of the fields used in reports.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-24896

Credits & Attribution

No credits recorded in the NVD database.

References

More from Enalean

View All →
CVE-2025-65962
Tuleap has missing CSRF protections its in tracker field dependencies
Medium 4.6
CVE-2025-64760
Tuleap has missing CSRF protections in its tracker trigger management system
Medium 4.6
CVE-2025-64499
Tuleap is missing CSRF protections for its planning management API
Medium 4.6
CVE-2025-64498
Tuleap has a Cross-Site Request Forgery (CSRF) vulnerability
Medium 4.6
CVE-2025-64497
Tuleap exposes releases for all projects to File Release System project administrators
Medium 6.5

Affected Vendor

Affected Software

tuleap
Vulnerable Versions:
< 13.7.99.239

Timeline

Official Publish: June 6th, 2022
Last Modified: April 23rd, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-862

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1078 Valid Accounts
Persistence
T1531 Account Access Removal
Impact