hitoshura25/cvefixes huggingface dataset:
CVE-2024-34082 (PHP, published 2024-05-15T17:15Z)
Description: value: Grav is a file-based Web platform. Prior to version 1.7.46, a low privilege user account with page edit privilege can read any server files using Twig Syntax. This includes Grav user account files - `/grav/user/accounts/*.yaml`. This file stores hashed user password, 2FA secret, and the password reset token. This can allow an adversary to compromise any registered account and read any file in the web server by resetting a password for a user to get access to the password reset token from the file or by cracking the hashed password. A low privileged user may also perform a full account takeover of other registered users including Administrators. Version 1.7.46 contains a patch.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/getgrav/grav
Files changed:
system/src/Grav/Common/Security.php
Commit message: fixes #GHSA-f8v5-jmfh-pr69


Vulnerable code:
            'on_events' => '#(<[^>]+[[a-z\x00-\x20\"\'\/])([\s\/]on|\sxmlns)[a-z].*=>?#iUu',

Fixed code:
            'on_events' => '#(<[^>]+[a-z\x00-\x20\"\'\/])(on[a-z]+|xmlns)\s*=[\s|\'\"].*[\s|\'\"]>#iUu',
            'read_file',
CVE-2018-7634 (Unknown, published 2018-03-01T23:29Z)
Description: value: An issue was discovered in Enalean Tuleap 9.17. Lack of CSRF attack mitigation while changing an e-mail address makes it possible to abuse the functionality by attackers. By making a CSRF attack, an attacker could make a victim change his registered e-mail address on the application, leading to account takeover.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/Enalean/tuleap
Files changed:
Commit message: Merge 'gerrit #10714' into stable/master

* commit 'd6701289ae':
  request #11217 Account takeover due to a missing CSRF protection

Change-Id: Id29f45cfa402f0cb378b9f257d1e7adb4b0d40be


Vulnerable code:

Fixed code:
CVE-2021-41142 (PHP, published 2021-10-14T16:15Z)
Description: value: Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. There is a cross-site scripting vulnerability in Tuleap Community Edition prior to 12.11.99.25 and Tuleap Enterprise Edition 12.11-2. A malicious user with the capability to add and remove attachment to an artifact could force a victim to execute uncontrolled code. Tuleap Community Edition 11.17.99.146 and Tuleap Enterprise Edition 12.11-2 contain a fix for the issue.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Enalean/tuleap
Files changed:
plugins/tracker/include/Tracker/Artifact/Tracker_Artifact_ChangesetValue_File.class.php
plugins/tracker/include/Tracker/FormElement/Tracker_FormElement_Field_File.php
Commit message: request #22570: XSS via the name of a deleted attachment

Change-Id: I3b7289c719ed8eacb836237fc186f59898b627bc


Vulnerable code:
                $result .= $removed . ' ' . dgettext('tuleap-tracker', 'removed');
                $query_link            = $this->getFileHTMLUrl($fileinfo);
                $add .= '<div class="tracker_artifact_attachment_size">(' . $fileinfo->getHumanReadableFilesize() . ')</div>';
                    $query_add = $this->getFileHTMLPreviewUrl($fileinfo);
                $query_link            = $this->getFileHTMLUrl($fileinfo);
                $info .= ' (' . $fileinfo->getHumanReadableFilesize() . ')';
                        $add  .= '<img src="' . $query . '"

Fixed code:
                $purifier = Codendi_HTMLPurifier::instance();
                $result  .= $purifier->purify($removed) . ' ' . dgettext('tuleap-tracker', 'removed');
                $query_link            = $hp->purify($this->getFileHTMLUrl($fileinfo));
                $add .= '<div class="tracker_artifact_attachment_size">(' . $hp->purify($fileinfo->getHumanReadableFilesize()) . ')</div>';
                    $query_add = $hp->purify($this->getFileHTMLPreviewUrl($fileinfo));
                $query_link            = $hp->purify($this->getFileHTMLUrl($fileinfo));
                $info .= ' (' . $hp->purify($fileinfo->getHumanReadableFilesize()) . ')';
                        $add  .= '<img src="' . $hp->purify($query) . '"
CVE-2021-41147 (PHP, published 2021-10-15T14:15Z)
Description: value: Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. Prior to version 11.16.99.173 of Community Edition and versions 11.16-6 and 11.15-8 of Enterprise Edition, an attacker with admin rights in one agile dashboard service can execute arbitrary SQL queries. Tuleap Community Edition 11.16.99.173, Tuleap Enterprise Edition 11.16-6, and Tuleap Enterprise Edition 11.15-8 contain a patch for this issue.
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/Enalean/tuleap
Files changed:
plugins/cardwall/include/OnTop/ColumnMappingFieldValueDao.class.php
Commit message: request #15131: SQL injection in the planning edition panel

Change-Id: Ifa9971534640010198196f34544f97eb8c7cc9c9


Vulnerable code:
 * Copyright (c) Enalean, 2012. All Rights Reserved.

Fixed code:
 * Copyright (c) Enalean, 2012-Present. All Rights Reserved.
        $value_id            = $this->da->escapeInt($value_id);
        $column_id           = $this->da->escapeInt($column_id);
CVE-2021-41276 (PHP, published 2021-12-15T20:15Z)
Description: value: Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. In affected versions Tuleap does not sanitize properly the search filter built from the ldap_id attribute of a user during the daily synchronization. A malicious user could force accounts to be suspended or take over another account by forcing the update of the ldap_uid attribute. Note that the malicious user either need to have site administrator capability on the Tuleap instance or be an LDAP operator with the capability to create/modify account. The Tuleap instance needs to have the LDAP plugin activated and enabled for this issue to be exploitable. This issue has been patched in Tuleap Community Edition 13.2.99.31, Tuleap Enterprise Edition 13.1-5, and Tuleap Enterprise Edition 13.2-3.
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/Enalean/tuleap
Files changed:
plugins/ldap/include/LDAP_DirectorySynchronization.class.php
src/common/DB/Compat/Legacy2018/LegacyDataAccessInterface.php
Commit message: request #24149: Indirect LDAP injection via the ldap_id attribute of a user

A taint annotation has been added to hightlight the issue. A more global
work on this topic will be done in independant contributions.

Change-Id: I969d0ba6d2ff85b418bcaf728f49afc78dd49571


Vulnerable code:
        $ldap_query = $this->ldap->getLDAPParam('eduid') . '=' . $row['ldap_id'];

Fixed code:
        $ldap_query = $this->ldap->getLDAPParam('eduid') . '=' . ldap_escape($row['ldap_id'], '', LDAP_ESCAPE_FILTER);
     * @psalm-taint-source ldap
CVE-2021-43782 (PHP, published 2021-12-15T20:15Z)
Description: value: Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. This is a follow up to GHSA-887w-pv2r-x8pm/CVE-2021-41276, the initial fix was incomplete. Tuleap does not sanitize properly the search filter built from the ldap_id attribute of a user during the daily synchronization. A malicious user could force accounts to be suspended or take over another account by forcing the update of the ldap_uid attribute. Note that the malicious user either need to have site administrator capability on the Tuleap instance or be an LDAP operator with the capability to create/modify account. The Tuleap instance needs to have the LDAP plugin activated and enabled for this issue to be exploitable. The following versions contain the fix: Tuleap Community Edition 13.2.99.83, Tuleap Enterprise Edition 13.1-6, and Tuleap Enterprise Edition 13.2-4.
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/Enalean/tuleap
Files changed:
plugins/ldap/include/LDAP_ProjectGroupDao.class.php
plugins/ldap/include/LDAP_UserManager.class.php
src/common/DB/Compat/Legacy2018/CompatPDODataAccess.php
src/common/DB/Compat/Legacy2018/LegacyDataAccessInterface.php
Commit message: request #24168: Indirect LDAP injection via the ldap_id attribute of a user when checking if it exists

This is a follow up to git #tuleap/stable/bd47f29847fcd6a68d359bc8aefb8749bb8a1b7c the initial fix was incomplete.
Issue was identified thanks to Psalm taint analysis.

Change-Id: I695be7d006e0cabdb9d4804f62772b0d88f3ffc0


Vulnerable code:
        $ldap_query = $this->ldap->getLDAPParam('eduid') . '=' . $row['ldap_id'];

Fixed code:
    /**
     * @psalm-taint-escape ldap DN is stored directly in plugin_ldap_project_group.ldap_group_dn, so we are forced to remove the taint
     */
        $ldap_query = $this->ldap->getLDAPParam('eduid') . '=' . ldap_escape($row['ldap_id'], '', LDAP_ESCAPE_FILTER);
     * @psalm-taint-source ldap
     * @psalm-taint-source ldap
     * @psalm-taint-source ldap
     * @psalm-taint-source ldap
     * @psalm-taint-source ldap
CVE-2021-43806 (PHP, published 2021-12-15T20:15Z)
Description: value: Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. In affected versions Tuleap does not sanitize properly user settings when constructing the SQL query to browse and search commits in the CVS repositories. A authenticated malicious user with read access to a CVS repository could execute arbitrary SQL queries. Tuleap instances without an active CVS repositories are not impacted. The following versions contain the fix: Tuleap Community Edition 13.2.99.155, Tuleap Enterprise Edition 13.1-7, and Tuleap Enterprise Edition 13.2-6.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/Enalean/tuleap
Files changed:
src/www/cvs/commit_utils.php
Commit message: request #24202: SQL injection via the user settings of the CVS commits browser

Change-Id: I9dff1d45d703de5c9a55182d673a70c21ea53d89


Vulnerable code:
    $repo_id        = $repo_id ? $repo_id : -1;
    "AND " . (check_cvs_access(user_getname(), $project->getUnixName(false), '') ? 1 : 0) . " " .
        $limit = " LIMIT $offset,$chunksz";

Fixed code:
    $repo_id        = db_ei($repo_id ? $repo_id : -1);
    "AND " . db_ei(check_cvs_access(user_getname(), $project->getUnixName(false), '') ? 1 : 0) . " " .
        $limit = " LIMIT " . db_ei($offset) . ',' . db_ei($chunksz);
CVE-2022-24896 (PHP, published 2022-06-09T06:15Z)
Description: value: Tuleap is a Free & Open Source Suite to manage software developments and collaboration. In versions prior to 13.7.99.239 Tuleap does not properly verify authorizations when displaying the content of tracker report renderer and chart widgets. Malicious users could use this vulnerability to retrieve the name of a tracker they cannot access as well as the name of the fields used in reports.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/Enalean/tuleap
Files changed:
plugins/graphontrackersv5/include/data-access/GraphOnTrackersV5_ChartFactory.class.php
plugins/tracker/include/Tracker/Widget/Tracker_Widget_Renderer.class.php
Commit message: request #26729 Tracker report renderer and chart widgets leak information user cannot access

Tracker report renderer and chart widgets leak information user cannot access

Change-Id: Ibdd7d1b8e72dd44bbb2b747b7d8f264603f98024


Vulnerable code:
            if ($renderer) {
        if ($renderer) {
            $tracker = $renderer->report->getTracker();
            $project = $tracker->getProject();
            if ($tracker->isActive() && $project->isActive()) {
                return $renderer;
            }

Fixed code:
            if ($renderer && $renderer->getReport()->getTracker()->userCanView()) {
        if ($renderer && $renderer->report->getTracker()->userCanView()) {
            return $renderer;
CVE-2022-31032 (Unknown, published 2022-06-29T18:15Z)
Description: value: Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.58 authorizations are not properly verified when creating projects or trackers from projects marked as templates. Users can get access to information in those template projects because the permissions model is not properly enforced. Users are advised to upgrade. There are no known workarounds for this issue.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/Enalean/tuleap
Files changed:
Commit message: Merge commit 'refs/changes/79/25979/8' of ssh://gerrit.tuleap.net:29418/tuleap into HEAD

* ssh://gerrit.tuleap.net:29418/tuleap:
  request #26816 Resources of private projects can be accessed by non project members


Vulnerable code:

Fixed code:
CVE-2022-31063 (PHP, published 2022-06-29T18:15Z)
Description: value: Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.111 the title of a document is not properly escaped in the search result of MyDocmanSearch widget and in the administration page of the locked documents. A malicious user with the capability to create a document could force victim to execute uncontrolled code. Users are advised to upgrade. There are no known workarounds for this issue.
Severity: LOW (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Enalean/tuleap
Files changed:
plugins/docman/include/Docman_Widget_MyDocmanSearch.class.php
plugins/docman/include/view/Docman_View_Admin_LockInfos.class.php
Commit message: request #27173: XSS via the title of a document

Change-Id: Ibdae4792b76c297bf8d553ab9b37f5ae3d76cb2a


Vulnerable code:
                    $html .= '<p><a data-test="document-search-link" href="/plugins/docman/?group_id=' . $res['group_id'] . '&action=details&id=' . $docman_id . '&section=properties">Show &quot;' . $res['title'] . '&quot; Properties</a></p>';
                $content .= '<td>' . '<a href="/plugins/docman/?group_id=' . $params['group_id'] . '&action=details&id=' . $item->getId() . '">' . $item->getTitle() . '</a></td>';
                    $content .=  '<a href="' . $this->defaultUrl . '&action=show&id=' . $parent->getId() . '">' . $parent->getTitle() . '</a></td>';

Fixed code:
                    $purifier = Codendi_HTMLPurifier::instance();
                    $html    .= '<p><a data-test="document-search-link" href="/plugins/docman/?group_id=' . urlencode((string) $res['group_id']) . '&action=details&id=' . urlencode((string) $docman_id) . '&section=properties">Show &quot;';
                    $html    .=  $purifier->purify($res['title']);
                    $html    .= '&quot; Properties</a></p>';
                $content .= '<td>' . '<a href="/plugins/docman/?group_id=' . urlencode((string) $params['group_id']) . '&action=details&id=' . urlencode((string) $item->getId()) . '">';
                $content .= $hp->purify($item->getTitle());
                $content .= '</a></td>';
                    $content .=  '<a href="' . $this->defaultUrl . '&action=show&id=' . urlencode((string) $parent->getId()) . '">';
                    $content .= $hp->purify($parent->getTitle());
                    $content .= '</a></td>';
CVE-2023-23938 (PHP, published 2023-04-20T17:15Z)
Description: value: Tuleap is a Free & Source tool for end to end traceability of application and system developments. Affected versions are subject to a cross site scripting attack which can be injected in the name of a color of select box values of a tracker and then reflected in the tracker administration. Administrative privilege is required, but an attacker with tracker administration rights could use this vulnerability to force a victim to execute uncontrolled code in the context of their browser. This issue has been addressed in Tuleap Community Edition version 14.5.99.4. Users are advised to upgrade. There are no known workarounds for this issue.
Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Enalean/tuleap
Files changed:
plugins/tracker/include/Tracker/FormElement/Tracker_FormElement_Field_List_Bind_StaticValue.php
Commit message: request #30734: XSS through the name of a color of select box values

Change-Id: Ia8dc1bf8cfb304975272064611b7b27264b884a3


Vulnerable code:
            $purifier = Codendi_HTTPPurifier::instance();

Fixed code:
            $purifier = Codendi_HTMLPurifier::instance();
CVE-2023-39521 (JavaScript, published 2023-08-24T23:15Z)
Description: value: Tuleap is an open source suite to improve management of software developments and collaboration. In Tuleap Community Edition prior to version 14.11.99.28 and Tuleap Enterprise Edition prior to versions 14.10-6 and 14.11-3, content displayed in the "card fields" (visible in the kanban and PV2 apps) is not properly escaped. An agile dashboard administrator deleting a kanban with a malicious label can be forced to execute uncontrolled code. Tuleap Community Edition 14.11.99.28, Tuleap Enterprise Edition 14.10-6, and Tuleap Enterprise Edition 14.11-3 contain a fix for this issue.
Severity: nan (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/Enalean/tuleap
Files changed:
plugins/kanban/scripts/kanban/po/fr_FR.po
plugins/kanban/scripts/kanban/src/app/kanban-service.js
Commit message: Fixes request #33656: XSS on the success message of a kanban deletion

Change-Id: I148a41056a269bb5b232c8a924db759401fb2b44


Vulnerable code:
msgid "Kanban {{ label }} successfuly deleted"
        var message = gettextCatalog.getString("Kanban {{ label }} successfuly deleted", {
            label: SharedPropertiesService.getKanban().label,

Fixed code:
msgid "Kanban {{ label }} successfully deleted"
import { escaper } from "@tuleap/html-escaper";
        const message = gettextCatalog.getString("Kanban {{ label }} successfully deleted", {
            label: escaper.html(SharedPropertiesService.getKanban().label),