CVE-2024-52599

Tuleap is an open source suite to improve management of software developments and collaboration. In Tuleap Community Edition prior to version 16.1.99.50 and Tuleap Enterprise Edition prior to versions 16.1-4 and 16.0-7, a malicious user with the ability to create an artifact in a tracker with a Gantt chart could force a victim to execute uncontrolled code. Tuleap Community Edition 16.1.99.50, Tuleap Enterprise Edition 16.1-4, and Tuleap Enterprise Edition 16.0-7 contain a fix.

• CWE-79

• https://github.com/Enalean/tuleap/commit/d3686ab152b6f64ff835e7dd3c99d97b36a9d4d5Patch
• https://github.com/Enalean/tuleap/security/advisories/GHSA-489c-fm2j-qjw7Patch, Third Party Advisory
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=d3686ab152b6f64ff835e7dd3c99d97b36a9d4d5Permissions Required
• https://tuleap.net/plugins/tracker/?aid=40459Exploit, Issue Tracking, Patch, Third Party Advisory

Published

Dec 9, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-52593Misskey is an open source, federated social media platform.I…5.3
• CVE-2024-52594Gomatrixserverlib is a Go library for matrix federation. Gom…4.3
• CVE-2024-52595lxml_html_clean is a project for HTML cleaning functionaliti…6.1
• CVE-2024-52596SimpleSAMLphp xml-common is a common classes for handling XM…8.8
• CVE-2024-525972FAuth is a web app to manage Two-Factor Authentication (2FA…6.1
• CVE-2024-525982FAuth is a web app to manage Two-Factor Authentication (2FA…7.5
• CVE-2024-5260The Sina Extension for Elementor (Slider, Gallery, Form, Mod…5.4
• CVE-2024-52600Statmatic is a Laravel and Git powered content management sy…5.3
• CVE-2024-52601iTop is an web based IT Service Management tool. Prior to ve…6.5
• CVE-2024-52602Matrix Media Repo (MMR) is a highly configurable multi-homes…5.3
• CVE-2024-52606SolarWinds Platform is affected by server-side request forge…9.8
• CVE-2024-5261Improper Certificate Validation vulnerability in LibreOffice…9.8