Log in Start free

Vulnerability · Published Dec 15, 2021 · Assigned by GitHub_M

CVE-2021-43806SQL injection in Tuleap

High 8.8

In plain English

A high-severity SQL injection in tuleap from Enalean. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.6%top 24.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. In affected versions Tuleap does not sanitize properly user settings when constructing the SQL query to browse and search commits in the CVS repositories. A authenticated malicious user with read access to a CVS repository could execute arbitrary SQL queries. Tuleap instances without an active CVS repositories are not impacted. The following versions contain the fix: Tuleap Community Edition 13.2.99.155, Tuleap Enterprise Edition 13.1-7, and Tuleap Enterprise Edition 13.2-6.

Affected products (as reported)

VendorProductVersions
Enalean tuleap < 13.2.99.155>= 13.1-1, < 13.1-7>= 13.2-1, < 13.2-6

Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References