关键漏洞信息 漏洞标题: Read permission not enforced on parent tracker in the REST API 漏洞ID: #42237 提交人: Joris MASSON (jmasson) 提交日期: 2025-03-18 19:07 最后修改日期: 2025-03-31 10:16 漏洞详情 摘要: - Given a child tracker C with a "parent" tracker P (in the Trackers Hierarchy sense), when I do a GET /api/trackers/{id of C}, even if I do not have permission to access tracker P at all, I can see its name and color in the JSON response. 影响: - An attacker could see tracker names that are not supposed to be revealed. - CVSSv3.1 score: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) 参考: - CVE-2023-30155 状态 状态: Closed 关闭日期: 2025-03-19 分配给: Joris MASSON (jmasson) 相关修复 修复版本: rel #41092 项目: Tuleap 跟踪器: Releases 版本: 16.6 状态: Delivered 最后更新日期: 2025-03-26 17:54 提交人: Manuel Vacelet (vaceletm) 分配给: Joris MASSON (jmasson) 跟踪记录 公开披露: Thomas Gerbet (tgerbet) - 10 hours ago CVE-2023-30155已分配给此问题: Thomas Gerbet (tgerbet) - 11 days ago 请求已通过git修复: Joris MASSON (jmasson) - 12 days ago