CVE-2022-23473— Tuleap MediaWiki standalone "readers" can also edit pages
Quick assessment
Affected
Enalean tuleap
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Tuleap是开源的一个应用程序生命周期管理系统，可促进敏捷软件开发，设计项目，V模型，需求管理和IT服务管理。 Tuleap 14.2.99.148 之前版本存在安全漏洞，该漏洞源于访问 MediaWiki 独立资源时未正确验证授权。
Possible ATT&CK Techniques 1 AI
T1136 · Create Account
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-23473
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Tuleap MediaWiki standalone "readers" can also edit pages
Source: CVE Program / CVE List V5
Vulnerability Description
Tuleap is an Open Source Suite to improve management of software developments and collaboration. In versions prior to 14.2.99.148, Authorizations are not properly verified when accessing MediaWiki standalone resources. Users with read only permissions for pages are able to also edit them. This only affects the MediaWiki standalone plugin. This issue is patched in versions Tuleap Community Edition 14.2.99.148, Tuleap Enterprise Edition 14.2-5, and Tuleap Enterprise Edition 14.1-6.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Vulnerability Title
Tuleap 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Tuleap是开源的一个应用程序生命周期管理系统，可促进敏捷软件开发，设计项目，V模型，需求管理和IT服务管理。 Tuleap 14.2.99.148 之前版本存在安全漏洞，该漏洞源于访问 MediaWiki 独立资源时未正确验证授权。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2022-23473
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-23473
请登录查看更多情报信息。
Vendor Advisories for CVE-2022-23473 (1)
-
https://github.com/Enalean/tuleap/security/advisories/GHSA-c7rr-5vmc-rgcw x_refsource_CONFIRM
Other References for CVE-2022-23473 (2)
-
https://tuleap.net/plugins/tracker/?aid=29645 x_refsource_MISC
IV. Related Vulnerabilities
Same product: tuleap
-
CVE-2026-24007
Tuleap is missing CSRF protection in the Overview inconsiste -
CVE-2025-65962
Tuleap has missing CSRF protections its in tracker field de -
CVE-2025-64760
Tuleap has missing CSRF protections in its tracker trigger m -
CVE-2025-64499
Tuleap is missing CSRF protections for its planning manageme -
CVE-2025-64498
Tuleap has a Cross-Site Request Forgery (CSRF) vulnerability
Same vendor: Enalean
-
CVE-2026-24007
Tuleap is missing CSRF protection in the Overview inconsiste -
CVE-2025-65962
Tuleap has missing CSRF protections its in tracker field de -
CVE-2025-64760
Tuleap has missing CSRF protections in its tracker trigger m -
CVE-2025-64499
Tuleap is missing CSRF protections for its planning manageme -
CVE-2025-64498
Tuleap has a Cross-Site Request Forgery (CSRF) vulnerability
Same weakness: CWE-863
-
CVE-2026-80202
Kimai before 2.56.0 Authorization Bypass via TimesheetVoter -
CVE-2026-16644
Webform REST - Moderately critical - Access bypass - SA-CONT -
CVE-2026-18985
Edit in-place field - Moderately critical - Access bypass - -
CVE-2026-68525
Apache Tomcat: Redirect after FORM auth may bypass method sp -
CVE-2026-80184
OpenStack Keystone越权漏洞
V. Comments for CVE-2022-23473
No comments yet