CVE-2022-39233

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions 12.9.99.228 and above, prior to 14.0.99.24, authorizations are not properly verified when updating the branch prefix used by the GitLab repository integration. Authenticated users can change the branch prefix of any of the GitLab repository integration they can see vie the REST endpoint `PATCH /gitlab_repositories/{id}`. This action should be restricted to Git administrators. This issue is patched in Tuleap Community Edition 14.0.99.24 and Tuleap Enterprise Edition 14.0-3. There are no known workarounds.

• CWE-862
• CWE-862

• https://github.com/Enalean/tuleap/commit/a06cb42d55c840d61a484472ed6b169ab23853acPatch, Third Party Advisory
• https://github.com/Enalean/tuleap/security/advisories/GHSA-3884-972x-3ccqThird Party Advisory
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=a06cb42d55c840d61a484472ed6b169ab23853acPatch, Vendor Advisory
• https://tuleap.net/plugins/tracker/?aid=28848Exploit, Vendor Advisory
• https://github.com/Enalean/tuleap/commit/a06cb42d55c840d61a484472ed6b169ab23853acPatch, Third Party Advisory
• https://github.com/Enalean/tuleap/security/advisories/GHSA-3884-972x-3ccqThird Party Advisory
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=a06cb42d55c840d61a484472ed6b169ab23853acPatch, Vendor Advisory
• https://tuleap.net/plugins/tracker/?aid=28848Exploit, Vendor Advisory

Published

Oct 19, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39228vantage6 is a privacy preserving federated learning infrastr…6.5
• CVE-2022-39229Grafana is an open source data visualization platform for me…4.3
• CVE-2022-3923The ActiveCampaign for WooCommerce WordPress plugin before 1…4.3
• CVE-2022-39230fhir-works-on-aws-authz-smart is an implementation of the au…6.5
• CVE-2022-39231Parse Server is an open source backend that can be deployed …3.7
• CVE-2022-39232Discourse is an open source discussion platform. Starting wi…4.3
• CVE-2022-39234GLPI stands for Gestionnaire Libre de Parc Informatique. GLP…8.8
• CVE-2022-39236Matrix Javascript SDK is the Matrix Client-Server SDK for Ja…5.3
• CVE-2022-39237syslabs/sif is the Singularity Image Format (SIF) reference …9.8
• CVE-2022-39238Arvados is an open source platform for managing and analyzin…8.8
• CVE-2022-39239netlify-ipx is an on-Demand image optimization for Netlify u…5.4
• CVE-2022-3924This issue can affect BIND 9 resolvers with `stale-answer-en…7.5