How severe is CVE-2024-30246?

CVE-2024-30246 has a CVSS 3.x base score of 7.6, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity high, and availability low.

Is CVE-2024-30246 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (45th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-30246?

CVE-2024-30246 primarily affects Enalean Tuleap. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2024-30246?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2024-30246 have an EU (EUVD) identifier?

Yes. CVE-2024-30246 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-28177.

When was CVE-2024-30246 published?

CVE-2024-30246 was published on 2024-03-29 and last updated on 2026-06-17.

CVE-2024-30246

CVE-2024-30246 is a high-severity vulnerability in Enalean Tuleap with a CVSS 3.x base score of 7.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-440.

Key facts

Severity: High (CVSS 3.x base score 7.6)
EPSS exploit prediction: 1% (45th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-28177
Weakness: CWE-440
Affected product: Enalean Tuleap
Published: 2024-03-29
Last modified: 2026-06-17

Description

Tuleap is an Open Source Suite to improve management of software developments and collaboration. A malicious user could exploit this issue on purpose to delete information on the instance or possibly gain access to restricted artifacts. It is however not possible to control exactly which information is deleted. Information from theDate, File, Float, Int, List, OpenList, Text, and Permissions on artifact (this one can lead to the disclosure of restricted information) fields can be impacted. This vulnerability is fixed in Tuleap Community Edition version 15.7.99.6 and Tuleap Enterprise Edition 15.7-2, 15.6-5, 15.5-6, 15.4-8, 15.3-6, 15.2-5, 15.1-9, 15.0-9, and 14.12-6.

Frequently asked questions

What is CVE-2024-30246?: Tuleap is an Open Source Suite to improve management of software developments and collaboration. A malicious user could exploit this issue on purpose to delete information on the instance or possibly gain access to restricted artifacts. It is however not possible to control exactly which information is deleted. Information from theDate, File, Float, Int, List, OpenList, Text, and Permissions on artifact (this one can lead to the disclosure of restricted information) fields can be impacted. This vulnerability is fixed in Tuleap Community Edition version 15.7.99.6 and Tuleap Enterprise Edition 15.7-2, 15.6-5, 15.5-6, 15.4-8, 15.3-6, 15.2-5, 15.1-9, 15.0-9, and 14.12-6.
How severe is CVE-2024-30246?: CVE-2024-30246 has a CVSS 3.x base score of 7.6, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity high, and availability low.
Is CVE-2024-30246 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (45th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-30246?: CVE-2024-30246 primarily affects Enalean Tuleap. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2024-30246?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2024-30246 have an EU (EUVD) identifier?: Yes. CVE-2024-30246 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-28177.
When was CVE-2024-30246 published?: CVE-2024-30246 was published on 2024-03-29 and last updated on 2026-06-17.

References

Affected products (3)

cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:*
cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:enalean:tuleap:15.7-1:*:*:*:enterprise:*:*:*

More vulnerabilities in Enalean Tuleap

CVE-2018-17298 — Critical (CVSS 9.8): An issue was discovered in Enalean Tuleap before 10.5. Reset password links are not invalidated after a user changes…
CVE-2018-7538 — Critical (CVSS 9.8): A SQL injection vulnerability in the tracker functionality of Enalean Tuleap software engineering platform before 9.18…
CVE-2014-7178 — Critical (CVSS 9.3): Enalean Tuleap before 7.5.99.6 allows remote attackers to execute arbitrary commands via the User-Agent header, which…
CVE-2021-43806 — High (CVSS 8.8): Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. In affected…
CVE-2021-41155 — High (CVSS 8.8): Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected…
CVE-2021-41154 — High (CVSS 8.8): Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected…

All CVEs affecting Enalean Tuleap →

Other CWE-440 vulnerabilities

CVE-2019-6569 — Critical (CVSS 9.1): The monitor barrier of the affected products insufficiently blocks data from being forwarded over the mirror port into…
CVE-2024-32971 — Critical (CVSS 9.0): Apollo Router is a configurable, graph router written in Rust to run a federated supergraph that uses Apollo Federation…
CVE-2025-8850 — High (CVSS 8.8): In danny-avila/librechat version 0.7.9, there is an insecure API design issue in the 2-Factor Authentication (2FA)…
CVE-2026-8806 — High (CVSS 8.7): Expected Behavior Violation vulnerability in Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Module…
CVE-2018-12550 — High (CVSS 8.1): When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is configured to use an ACL file, and that ACL file is empty,…
CVE-2023-4807 — High (CVSS 7.8): Issue summary: The POLY1305 MAC (message authentication code) implementation contains a bug that might corrupt the…

Browse all CWE-440 vulnerabilities →