CVE-2023-48715

    Dashboard / Vulnerabilities / CVE-2023-48715

    CVE-2023-48715

    Published: 11 Dec 2023Last Modified: 10 Apr 2026

    Summary: Tuleap vulnerable to Cross-site Scripting on the edition page of a release

    Details: Tuleap is an open source suite to improve management of software developments and collaboration. Prior to version 15.2.99.103 of Tuleap Community Edition and prior to versions 15.2-4 and 15.1-8 of Tuleap Enterprise Edition, the name of the releases are not properly escaped on the edition page of a release. A malicious user with the ability to create a FRS release could force a victim having write permissions in the FRS to execute uncontrolled code. Tuleap Community Edition 15.2.99.103, Tuleap Enterprise Edition 15.2-4, and Tuleap Enterprise Edition 15.1-8 contain a fix for this issue.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48715.json, https://github.com/Enalean/tuleap/commit/ea71ec7ee062aae8d1fa7a7325aaa759205c17d8, https://github.com/Enalean/tuleap/security/advisories/GHSA-3m7g-7787-wc68, https://nvd.nist.gov/vuln/detail/CVE-2023-48715, https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=ea71ec7ee062aae8d1fa7a7325aaa759205c17d8, https://tuleap.net/plugins/tracker/?aid=35143

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -ea71ec7ee062aae8d1fa7a7325aaa759205c17d8

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High