Security readout for executives and security teams
Plain-English summary
Tuleap versions before 13.9.99.111 mishandle document titles in specific search and administration views. A user who can create documents could set a malicious title that runs code in another user's browser when viewed. This is a medium-severity business risk for Tuleap environments with many contributors or administrators using affected document features.
Executive priority
Patch during the next normal security maintenance window, sooner for externally collaborative Tuleap deployments. The issue is not reported as actively exploited, but it can affect administrator sessions and trusted collaboration workflows.
Technical view
CVE-2022-31063 is a stored cross-site scripting issue in Tuleap's MyDocmanSearch widget results and locked-documents administration page. The vulnerable field is a document title that was not properly escaped. The attacker needs document creation capability, and exploitation requires a victim to view affected output. CVSS is 6.5 with changed scope and low confidentiality, integrity, and availability impact.
Likely exposure
Exposure is likely limited to organizations running Tuleap before 13.9.99.111 where untrusted or semi-trusted users can create documents and other users view MyDocmanSearch results or locked document administration pages.
Exploitation context
The provided sources do not show known active exploitation, and the CVE is not listed as KEV. Abuse requires an authenticated or authorized user with document creation capability and victim interaction through affected Tuleap pages.
Researcher notes
Focus validation on stored XSS exposure in document-title rendering paths. The source bundle identifies the affected views and patch commit but does not provide operational exploit evidence beyond the advisory description.
Mitigation direction
- Upgrade Tuleap to version 13.9.99.111 or later.
- Review the GitHub advisory and Tuleap tracker entry for vendor guidance.
- Do not rely on workarounds; the advisory states none are known.
- Prioritize instances with broad document creation rights or external collaborators.
- Review document creation permissions as exposure reduction, not a substitute for patching.
Validation and detection
- Inventory Tuleap instances and confirm versions are at least 13.9.99.111.
- Confirm MyDocmanSearch and locked-document administration views are served by patched code.
- Identify users or groups with document creation capability in affected projects.
- Review recent document titles for suspicious script-like or encoded content.
- Check whether affected Tuleap instances are reachable by external collaborators.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-31063 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L2.33.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/Enalean/tuleap/security/advisories/GHSA-4fx8-4ff3-96jfCVE reference · x_refsource_CONFIRM
- https://github.com/Enalean/tuleap/commit/c947975a4f1ff7bbfd7d5cd24a2e16bf12bd96d4CVE reference · x_refsource_MISC
- https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=c947975a4f1ff7bbfd7d5cd24a2e16bf12bd96d4CVE reference · x_refsource_MISC
- https://tuleap.net/plugins/tracker/?aid=27173CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.