CVE-2022-31063

    Dashboard / Vulnerabilities / CVE-2022-31063

    CVE-2022-31063

    Published: 29 Jun 2022Last Modified: 10 Apr 2026

    Summary: Cross site scripting via the title of a document in Tuleap

    Details: Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.111 the title of a document is not properly escaped in the search result of MyDocmanSearch widget and in the administration page of the locked documents. A malicious user with the capability to create a document could force victim to execute uncontrolled code. Users are advised to upgrade. There are no known workarounds for this issue.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31063.json, https://github.com/Enalean/tuleap/commit/c947975a4f1ff7bbfd7d5cd24a2e16bf12bd96d4, https://github.com/Enalean/tuleap/security/advisories/GHSA-4fx8-4ff3-96jf, https://nvd.nist.gov/vuln/detail/CVE-2022-31063, https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=c947975a4f1ff7bbfd7d5cd24a2e16bf12bd96d4, https://tuleap.net/plugins/tracker/?aid=27173

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -c947975a4f1ff7bbfd7d5cd24a2e16bf12bd96d4

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-31063 | CVE-DB