Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2022-39233 Details

Description

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions 12.9.99.228 and above, prior to 14.0.99.24, authorizations are not properly verified when updating the branch prefix used by the GitLab repository integration. Authenticated users can change the branch prefix of any of the GitLab repository integration they can see vie the REST endpoint `PATCH /gitlab_repositories/{id}`. This action should be restricted to Git administrators. This issue is patched in Tuleap Community Edition 14.0.99.24 and Tuleap Enterprise Edition 14.0-3. There are no known workarounds.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:5.4 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CNA: [email protected]CVSS-B:4.3 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/Enalean/tuleap/commit/a06cb42d55c840d61a484472ed6b169ab23853ac	CVE	PatchThird Party Advisory
https://github.com/Enalean/tuleap/security/advisories/GHSA-3884-972x-3ccq	CVE	Third Party Advisory
https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=a06cb42d55c840d61a484472ed6b169ab23853ac	CVE	PatchVendor Advisory
https://tuleap.net/plugins/tracker/?aid=28848	CVE	ExploitVendor Advisory
https://github.com/Enalean/tuleap/commit/a06cb42d55c840d61a484472ed6b169ab23853ac	[email protected]	PatchThird Party Advisory
https://github.com/Enalean/tuleap/security/advisories/GHSA-3884-972x-3ccq	[email protected]	Third Party Advisory
https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=a06cb42d55c840d61a484472ed6b169ab23853ac	[email protected]	PatchVendor Advisory
https://tuleap.net/plugins/tracker/?aid=28848	[email protected]	ExploitVendor Advisory

see all 8 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-862	Missing Authorization	[email protected]
CWE-862	Missing Authorization	[email protected]

Affected Products

Product	Versions
enalean tuleap	>= 12.9.99.228, < 14.0.99.24 >= 12.10, < 13.12-6 >= 14.0, < 14.0-3
CPE cpe:2.3:a:enalean:tuleap:::::community:::* cpe:2.3:a:enalean:tuleap:::::enterprise:::* Remediation No remediation found in references.

Change History

6 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Jun 17, 2026	CVE Modified	CISA-ADP
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Jul 14, 2023	Reanalysis	[email protected]
Oct 21, 2022	Initial Analysis	[email protected]