CVE-2021-41155
Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.53%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected versions Tuleap does not sanitize properly user inputs when constructing the SQL query to browse and search revisions in the CVS repositories. The following versions contain the fix: Tuleap Community Edition 11.17.99.146, Tuleap Enterprise Edition 11.17-5, Tuleap Enterprise Edition 11.16-7.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.53% probability · 73th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- enalean/tuleap
- Source
- security-advisories@github.com
References
- https://github.com/Enalean/tuleap/commit/ff75f2899c60a4546ee2d532e68a3febd07bdd14Patch, Third Party Advisory
- https://github.com/Enalean/tuleap/security/advisories/GHSA-f8jp-hx4q-wxvrPatch, Third Party Advisory
- https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=ff75f2899c60a4546ee2d532e68a3febd07bdd14Patch, Vendor Advisory
- https://tuleap.net/plugins/tracker/?aid=16214Vendor Advisory
- https://github.com/Enalean/tuleap/commit/ff75f2899c60a4546ee2d532e68a3febd07bdd14Patch, Third Party Advisory
- https://github.com/Enalean/tuleap/security/advisories/GHSA-f8jp-hx4q-wxvrPatch, Third Party Advisory
- https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=ff75f2899c60a4546ee2d532e68a3febd07bdd14Patch, Vendor Advisory
- https://tuleap.net/plugins/tracker/?aid=16214Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.