Skip to main content

Public

Project privacy set to public. By default, its content is available to everyone (authenticated or not). Please note that more restrictive permissions might exist on some items.

    •  
      request #26816 Resources of private projects can be accessed by non project members
    Actions
    Infos
    #26816
    Thomas Gerbet (tgerbet)
    2022-06-29 10:50
    2022-05-20 11:12
    28339
    Details
    Resources of private projects can be accessed by non project members

    Authorizations are not properly verified when creating projects or trackers from projects marked as templates.

    Impact

    Users can get access to information in those template projects because the permissions model is not properly enforced.

    CVSSv3.1 score: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

    Exploitation

    • As a non member of a private template project create a new project from it
    • As a user that cannot see a tracker in a template project, create a new tracker from it

    References

    CWE 285
    CVE-2022-31032

    Other
    All
    Empty
    • [ ] enhancement
    • [ ] internal improvement
    Empty
    Stage
    Lorentz Romain (lorentzr)
    Closed
    2022-06-21
    Attachments
    Empty
    References
    Referencing request #26816

    Git commit

    tuleap/tuleap/stable

    Revert "request #26785 Project creation can be broken if the template is private" 8e49b0a8ef
    User avatar Lorentz Romain (lorentzr) , 2022-05-23 10:34
    Merge commit 'refs/changes/79/25979/8' of ssh://gerrit.tuleap.net:29418/tuleap into HEAD cc38bcc59c
    User avatar Nicolas Terray (nterray) , 2022-06-06 14:20
    request #26816 Resources of private projects can be accessed by non project members 7e221a9d18
    User avatar Lorentz Romain (lorentzr) , 2022-06-02 11:14
    Clean-up unused properties d7d9a542c2
    User avatar Thomas Gerbet (tgerbet) , 2022-06-07 09:34
    Referenced by request #26816

    Artifact Tracker v5

    rel #25714 13.10

    Other

    gerrit #25979
    gerrit #26079
    Display settings

    Follow-ups

    User avatar
    Thomas Gerbet (tgerbet)2022-06-21 10:18

    CVE-2022-31032 has been assigned to this issue.

    • Original Submission
      Something went wrong, the follow up content couldn't be loaded
      Only formatting have been changed, you should switch to markup to see the changes
    • Status changed from Under implementation to Closed
    • Connected artifacts
    • Close date set to 2022-06-21
    User avatar
    Lorentz Romain (lorentzr)2022-05-20 14:23
    • Status changed from Verified to Under implementation
    • Assigned to changed from None to Lorentz Romain (lorentzr)