CVE-2024-37167 MEDIUM

CVE-2024-37167: Tuleap has improper permissions of the backlog items

Vendor Enalean

Product tuleap

Weakness CWE-285

Published June 25, 2024

Last update August 2, 2024

View on NVD All CVEs

CVSS base score

4.3/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality Low

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Users are able to see backlog items that they should not see. This issue has been patched in Tuleap Community Edition version 15.9.99.97.

Key dates

02Disclosure timeline

June 25, 2024 CVE published

August 2, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-37167 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/285.html

Related vulnerabilities

04Related CVE

CVE-2025-0849 CampCodes School Management Software Staff edit-staff improper authorization CVE-2025-8401 HT Mega – Absolute Addons For Elementor <= 2.9.1 - Authenticated (Author+) Sensitive Information Exposure CVE-2023-38135 CVE-2021-21096 Adobe Bridge Genuine Software Service Incorrect Permission Assignment could lead to Denial-of-Service CVE-2025-3536 Tutorials-Website Employee Management System delete-user.php improper authorization