CVE-2022-24896: Missing Authorization (CWE-862)
value: Tuleap is a Free & Open Source Suite to manage software developments and collaboration. In versions prior to 13.7.99.239 Tuleap does not properly verify authorizations when displaying the content of tracker report renderer and chart widgets. Malicious users could use this vulnerability to retrieve the name of a tracker they cannot access as well as the name of the fields used in reports.
CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 4.3
Published: 2022-06-09T06:15Z
Repository: https://github.com/Enalean/tuleap
Language: PHP
Files changed: plugins/graphontrackersv5/include/data-access/GraphOnTrackersV5_ChartFactory.class.php, plugins/tracker/include/Tracker/Widget/Tracker_Widget_Renderer.class.php
Commit date: 2022-04-27 17:27:14 +0200
Commit message: request #26729 Tracker report renderer and chart widgets leak information user cannot access

Tracker report renderer and chart widgets leak information user cannot access

Change-Id: Ibdd7d1b8e72dd44bbb2b747b7d8f264603f98024

Diff: diff --git a/plugins/graphontrackersv5/include/data-access/GraphOnTrackersV5_ChartFactory.class.php b/plugins/graphontrackersv5/include/data-access/GraphOnTrackersV5_ChartFactory.class.php
index 2697e43948fc..aba04cefb6f3 100644
--- a/plugins/graphontrackersv5/include/data-access/GraphOnTrackersV5_ChartFactory.class.php
+++ b/plugins/graphontrackersv5/include/data-access/GraphOnTrackersV5_ChartFactory.class.php
@@ -250,11 +250,11 @@ class GraphOnTrackersV5_ChartFactory
         if ($chart_data) {
             if (! $renderer) {
                 $report   = null; //We don't know the report
                 $renderer = Tracker_Report_RendererFactory::instance()->getReportRendererById($chart_data['report_graphic_id'], $report, $store_in_session);
             }
-            if ($renderer) {
+            if ($renderer && $renderer->getReport()->getTracker()->userCanView()) {
                 $c = $this->instanciateChart($chart_data, $renderer, $store_in_session);
             }
         }
         return $c;
     }
diff --git a/plugins/tracker/include/Tracker/Widget/Tracker_Widget_Renderer.class.php b/plugins/tracker/include/Tracker/Widget/Tracker_Widget_Renderer.class.php
index 59061ca7ed7a..2bd3c7800516 100644
--- a/plugins/tracker/include/Tracker/Widget/Tracker_Widget_Renderer.class.php
+++ b/plugins/tracker/include/Tracker/Widget/Tracker_Widget_Renderer.class.php
@@ -56,16 +56,12 @@ abstract class Tracker_Widget_Renderer extends Widget
     private function getRenderer(): ?Tracker_Report_Renderer
     {
         $store_in_session = false;
         $arrf             = Tracker_Report_RendererFactory::instance();
         $renderer         = $arrf->getReportRendererById($this->renderer_id, null, $store_in_session);
-        if ($renderer) {
-            $tracker = $renderer->report->getTracker();
-            $project = $tracker->getProject();
-            if ($tracker->isActive() && $project->isActive()) {
-                return $renderer;
-            }
+        if ($renderer && $renderer->report->getTracker()->userCanView()) {
+            return $renderer;
         }
         return null;
     }
 
     public function isAjax()

Vulnerable code:             if ($renderer) {
        if ($renderer) {
            $tracker = $renderer->report->getTracker();
            $project = $tracker->getProject();
            if ($tracker->isActive() && $project->isActive()) {
                return $renderer;
            }
Fixed code:             if ($renderer && $renderer->getReport()->getTracker()->userCanView()) {
        if ($renderer && $renderer->report->getTracker()->userCanView()) {
            return $renderer;