Tuleap CVE-2024-46980 XSS in HTML mail content fix

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability Description: - Title: XSS in the HTML mail content of the cross reference field - Description: Content of cross reference field is not properly escaped in mail notifications. 2. Impact: - Description: A site administrator could create an artifact link type with a forward label allowing to execute uncontrolled code (or at least achieve content injection) in a mail client. - CVSSv3.1 score: 4.8 (AV:N/AC:L/PR:H/UI:R/S:C/N/I:L/A:L) 3. References: - CWE: 79 - OWASP Cross-site Scripting - CVE-2024-46980 4. Status: - Status: Closed - Closed Date: 2024-09-17 5. Associated Patch: - Patch ID: rel #37898 - Project: Tuleap - Version: 16.0 - Status: Delivered - Commit Time: 2024-10-09 15:47 - Committer: Manuel Vacelet (vaceletm) 6. References: - Reference Request: #39689 - Git Commit: - Commit ID: dd94a79998 - Committer: Thomas Gerbet (tgerbet) - Commit Time: 28 days ago - Description: fix: request #39689 XSS in the HTML mail content of the cross reference field This information provides detailed insights into the vulnerability’s description, impact, references, status, associated patch, and related request.

Goal Reached Thanks to every supporter — we hit 100%!

Tuleap CVE-2024-46980 XSS in HTML mail content fix