CVE-2023-30619

Tuleap Open ALM is a Libre and Open Source tool for end to end traceability of application and system developments. The title of an artifact is not properly escaped in the tooltip. A malicious user with the capability to create an artifact or to edit a field title could force victim to execute uncontrolled code. This issue has been patched in version 14.7.99.143.

• CWE-79
• CWE-79

• https://github.com/Enalean/tuleap/commit/fdc93a736cbccad05de16ff0cc7cc3ef18dc93dfPatch
• https://github.com/Enalean/tuleap/security/advisories/GHSA-7fm3-cr3g-5922Patch, Vendor Advisory
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=fdc93a736cbccad05de16ff0cc7cc3ef18dc93dfPatch
• https://tuleap.net/plugins/tracker/?aid=31586Patch, Vendor Advisory
• https://github.com/Enalean/tuleap/commit/fdc93a736cbccad05de16ff0cc7cc3ef18dc93dfPatch
• https://github.com/Enalean/tuleap/security/advisories/GHSA-7fm3-cr3g-5922Patch, Vendor Advisory
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=fdc93a736cbccad05de16ff0cc7cc3ef18dc93dfPatch
• https://tuleap.net/plugins/tracker/?aid=31586Patch, Vendor Advisory

Published

May 4, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-30613Kiwi TCMS, an open source test management system, allows use…9
• CVE-2023-30614Pay is a payments engine for Ruby on Rails 6.0 and higher. I…6.1
• CVE-2023-30615Iris is a web collaborative platform aiming to help incident…5.4
• CVE-2023-30616Form block is a wordpress plugin designed to make form creat…6.5
• CVE-2023-30617Kruise provides automated management of large-scale applicat…6.5
• CVE-2023-30618Kitchen-Terraform provides a set of Test Kitchen plugins whi…3.3
• CVE-2023-3062A vulnerability was found in code-projects Agro-School Manag…9.8
• CVE-2023-30620mindsdb is a Machine Learning platform to help developers bu…7.5
• CVE-2023-30621Gipsy is a multi-purpose discord bot which aim to be as modu…9.8
• CVE-2023-30622Clusternet is a general-purpose system for controlling Kuber…8.8
• CVE-2023-30623`embano1/wip` is a GitHub Action written in Bash. Prior to v…8.8
• CVE-2023-30624Wasmtime is a standalone runtime for WebAssembly. Prior to v…8.8