CVE-2022-24896 (published 2022-06-09T06:15Z)

Tuleap is a Free & Open Source Suite to manage software developments and collaboration. In versions prior to 13.7.99.239 Tuleap does not properly verify authorizations when displaying the content of tracker report renderer and chart widgets. Malicious users could use this vulnerability to retrieve the name of a tracker they cannot access as well as the name of the fields used in reports.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)
CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-862
cwe_name: Missing Authorization
description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are not applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/Enalean/tuleap
commit_details: repo_url: https://github.com/Enalean/tuleap
author: Romain LORENTZ
author_date: 2022-04-27 15:27:54+02:00
msg: request #26729 Tracker report renderer and chart widgets leak information user cannot access

Tracker report renderer and chart widgets leak information user cannot access

Change-Id: Ibdd7d1b8e72dd44bbb2b747b7d8f264603f98024
repository: repo_url: https://github.com/Enalean/tuleap
repo_name: Enalean/tuleap
description: Tuleap is an Open Source Suite to improve management of software developments and collaboration. With a single web-based solution, project managers, developers & quality managers can easily build, deploy software projects.
repo_language: PHP
owner: Enalean
file_changes: filename: GraphOnTrackersV5_ChartFactory.class.php
change_type: ModificationType.MODIFY
diff: @@ -252,7 +252,7 @@ class GraphOnTrackersV5_ChartFactory
                 $report   = null; //We don't know the report
                 $renderer = Tracker_Report_RendererFactory::instance()->getReportRendererById($chart_data['report_graphic_id'], $report, $store_in_session);
             }
-            if ($renderer) {
+            if ($renderer && $renderer->getReport()->getTracker()->userCanView()) {
                 $c = $this->instanciateChart($chart_data, $renderer, $store_in_session);
             }
         }

programming_language: PHP
filename: Tracker_Widget_Renderer.class.php
change_type: ModificationType.MODIFY
diff: @@ -58,12 +58,8 @@ abstract class Tracker_Widget_Renderer extends Widget
         $store_in_session = false;
         $arrf             = Tracker_Report_RendererFactory::instance();
         $renderer         = $arrf->getReportRendererById($this->renderer_id, null, $store_in_session);
-        if ($renderer) {
-            $tracker = $renderer->report->getTracker();
-            $project = $tracker->getProject();
-            if ($tracker->isActive() && $project->isActive()) {
-                return $renderer;
-            }
+        if ($renderer && $renderer->report->getTracker()->userCanView()) {
+            return $renderer;
         }
         return null;
     }

programming_language: PHP