CVE-2024-47766 - CVE House
Back to Database
Status published Medium CVE-2024-47766

Permissions are incorrectly verified for project administrators in the cross tracker search widget

Vulnerability Description

Tuleap is a tool for end to end traceability of application and system developments. Prior to Tuleap Community Edition 15.13.99.110, Tuleap Enterprise Edition 15.13-5, and Tuleap Enterprise Edition 15.12-5, administrators of a project can access the content of trackers with permissions restrictions of project they are members of but not admin via the cross tracker search widget. Tuleap Community Edition 15.13.99.110, Tuleap Enterprise Edition 15.13-5, and Tuleap Enterprise Edition 15.12-8 fix this issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-47766

Credits & Attribution

No credits recorded in the NVD database.

References

More from Enalean

View All →
CVE-2025-65962
Tuleap has missing CSRF protections its in tracker field dependencies
Medium 4.6
CVE-2025-64760
Tuleap has missing CSRF protections in its tracker trigger management system
Medium 4.6
CVE-2025-64499
Tuleap is missing CSRF protections for its planning management API
Medium 4.6
CVE-2025-64498
Tuleap has a Cross-Site Request Forgery (CSRF) vulnerability
Medium 4.6
CVE-2025-64497
Tuleap exposes releases for all projects to File Release System project administrators
Medium 6.5

Affected Vendor

Affected Software

tuleap
Vulnerable Versions:
< 15.13.99.110, < 15.13-5, < 15.12-8

Timeline

Official Publish: October 14th, 2024
Last Modified: October 15th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-280

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.