CVE-2024-25130

Tuleap is an open source suite to improve management of software developments and collaboration. Prior to version 15.5.99.76 of Tuleap Community Edition and prior to versions 15.5-4 and 15.4-7 of Tuleap Enterprise Edition, users with a read access to a tracker where the mass update feature is used might get access to restricted information. Tuleap Community Edition 15.5.99.76, Tuleap Enterprise Edition 15.5-4, and Tuleap Enterprise Edition 15.4-7 contain a patch for this issue.

• CWE-200

• https://github.com/Enalean/tuleap/commit/57978a32508f5c6d0365419b6eaeb368aee20667Patch
• https://github.com/Enalean/tuleap/security/advisories/GHSA-mq7f-m6mj-hjj5Patch, Vendor Advisory
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=57978a32508f5c6d0365419b6eaeb368aee20667Broken Link
• https://tuleap.net/plugins/tracker/?aid=36803Vendor Advisory
• https://github.com/Enalean/tuleap/commit/57978a32508f5c6d0365419b6eaeb368aee20667Patch
• https://github.com/Enalean/tuleap/security/advisories/GHSA-mq7f-m6mj-hjj5Patch, Vendor Advisory
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=57978a32508f5c6d0365419b6eaeb368aee20667Broken Link
• https://tuleap.net/plugins/tracker/?aid=36803Vendor Advisory

Published

Feb 22, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-25124Fiber is a web framework written in go. Prior to version 2.5…9.8
• CVE-2024-25125Digdag is an open source tool that to build, run, schedule, …5.3
• CVE-2024-25126Rack is a modular Ruby web server interface. Carefully craft…7.5
• CVE-2024-25128Flask-AppBuilder is an application development framework, bu…9.1
• CVE-2024-25129The CodeQL CLI repo holds binaries for the CodeQL command li…5.5
• CVE-2024-2513The WP Chat App plugin for WordPress is vulnerable to Stored…5.4
• CVE-2024-25131A flaw was found in the MustGather.managed.openshift.io Cust…8.8
• CVE-2024-25132A flaw was found in the Hive hibernation controller componen…4.3
• CVE-2024-25133A flaw was found in the Hive ClusterDeployments resource in …8.8
• CVE-2024-25136 There is a function in AutomationDirect C-MORE EA9 HMI that…7.5
• CVE-2024-25137 In AutomationDirect C-MORE EA9 HMI there is a program that …4.3
• CVE-2024-25138 In AutomationDirect C-MORE EA9 HMI, credentials used by t…6.5