•  
      request #39728 Trackers are listed in the quick add actions of the backlog without any permissions check
    Infos
    #39728
    Sandra Echinard (sechinard)
    2024-10-14 09:38
    2024-09-26 15:09
    41363
    Details
    Trackers are listed in the quick add actions of the backlog without any permissions check

    Impact

    Users might see tracker names they should not have access to.

    CVSSv3.1 score: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

    Exploitation

    Have a user that cannot access a tracker and have this tracker in list of items of items that can be planned in your Backlog service.

    The action "+ Add ..." shouldn't be displayed in the backlog.

    References

    CWE-280
    CVE-2024-47767

    Agile Dashboard
    Empty
    Empty
    • [ ] enhancement
    • [ ] internal improvement
    Empty
    Stage
    Nicolas Terray (nterray)
    Closed
    2024-09-30
    Attachments
    References

    Follow-ups

    User avatar
    Thomas Gerbet (tgerbet)2024-10-04 17:14

    CVE-2024-47767 has been assigned to this issue.


    • Original Submission
      Something went wrong, the follow up content couldn't be loaded
      Only formatting have been changed, you should switch to markup to see the changes
    User avatar
    Thomas Gerbet (tgerbet)2024-09-30 17:10
    • Summary
      -If a user does not have access at all to a tracker, it should not be displayed in the backlog. 
      +Trackers are listed in the quick add actions of the backlog without any permissions check 
    • Original Submission
      Something went wrong, the follow up content couldn't be loaded
      Only formatting have been changed, you should switch to markup to see the changes
    • Category changed from Trackers to Agile Dashboard
    • Status changed from Under review to Closed
    • Connected artifacts
    • Close date set to 2024-09-30
    User avatar
    • Summary
      -If a user does not have access at all to a tracker, it should be displayed in the backlog. 
      +If a user does not have access at all to a tracker, it should not be displayed in the backlog.