Tuleap File Release System Unauthorized Access Vulnerability

A vulnerability exists in Tuleap Community Edition versions prior to 17.0.99.1762431347 and Tuleap Enterprise Edition versions prior to 17.0-2, 16.13-7, and 16.12-10. This vulnerability allows FRS project administrators to access file release information in projects where they do not have permission.

Impact

Exploitation of this vulnerability could lead to unauthorized access to file release information in restricted projects.

Reproduction

To reproduce this vulnerability, a project or FRS administrator in one project can access releases in another project where they should not have rights. This can be done by navigating to the WebDAV interface for the target project and package, which will return release information regardless of the user's permissions.

Remediation

Users can upgrade to Tuleap Community Edition 17.0.99.1762431347 or Tuleap Enterprise Edition 17.0-2, 16.13-7, or 16.12-10.