Vulnerability CVE-2023-32072
Published: 2023-05-29

Description:
Tuleap is an open source tool for end to end traceability of application and system developments. Tuleap Community Edition prior to version 14.8.99.60 and Tuleap Enterprise edition prior to 14.8-3 and 14.7-7, the logs of the triggered Jenkins job URLs are not properly escaped. A malicious Git administrator can setup a malicious Jenkins hook to make a victim, also a Git administrator, execute uncontrolled code. Tuleap Community Edition 14.8.99.60, Tuleap Enterprise Edition 14.8-3, and Tuleap Enterprise Edition 14.7-7 contain a patch for this issue.

 References:
https://github.com/Enalean/tuleap/security/advisories/GHSA-6prc-j58r-fmjq
https://tuleap.net/plugins/tracker/?aid=31929
https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=6840529def97f564844e810e5a7c5bf837cf58d5
https://github.com/Enalean/tuleap/commit/6840529def97f564844e810e5a7c5bf837cf58d5
Copyright 2026, cxsecurity.com

 

Back to Top