Description
Tuleap Open ALM is a Libre and Open Source tool for end to end traceability of application and system developments. The title of an artifact is not properly escaped in the tooltip. A malicious user with the capability to create an artifact or to edit a field title could force victim to execute uncontrolled code. This issue has been patched in version 14.7.99.143.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Enalean tuleap
>= 14.7.99.76, < 14.7.99.143affected
References
- https://github.com/Enalean/tuleap/security/advisories/GHSA-7fm3-cr3g-5922 ↗
- https://github.com/Enalean/tuleap/commit/fdc93a736cbccad05de16ff0cc7cc3ef18dc93df ↗
- https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=fdc93a736cbccad05de16ff0cc7cc3ef18dc93df ↗
- https://tuleap.net/plugins/tracker/?aid=31586 ↗