CVE-2021-41276
A malicious user could force accounts to be suspended or take over another account by forcing the update of the ldap_uid attribute.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.48%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. In affected versions Tuleap does not sanitize properly the search filter built from the ldap_id attribute of a user during the daily synchronization. A malicious user could force accounts to be suspended or take over another account by forcing the update of the ldap_uid attribute. Note that the malicious user either need to have site administrator capability on the Tuleap instance or be an LDAP operator with the capability to create/modify account. The Tuleap instance needs to have the LDAP plugin activated and enabled for this issue to be exploitable. This issue has been patched in Tuleap Community Edition 13.2.99.31, Tuleap Enterprise Edition 13.1-5, and Tuleap Enterprise Edition 13.2-3.
- CVSS 3.1
- 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.48% probability · 72th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-74, CWE-90
- Affected
- enalean/tuleap
- Source
- security-advisories@github.com
References
- https://github.com/Enalean/tuleap/commit/bd47f29847fcd6a68d359bc8aefb8749bb8a1b7cPatch, Third Party Advisory
- https://github.com/Enalean/tuleap/security/advisories/GHSA-887w-pv2r-x8pmThird Party Advisory
- https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=bd47f29847fcd6a68d359bc8aefb8749bb8a1b7cPatch, Vendor Advisory
- https://tuleap.net/plugins/tracker/?aid=24149Issue Tracking, Patch, Vendor Advisory
- https://github.com/Enalean/tuleap/commit/bd47f29847fcd6a68d359bc8aefb8749bb8a1b7cPatch, Third Party Advisory
- https://github.com/Enalean/tuleap/security/advisories/GHSA-887w-pv2r-x8pmThird Party Advisory
- https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=bd47f29847fcd6a68d359bc8aefb8749bb8a1b7cPatch, Vendor Advisory
- https://tuleap.net/plugins/tracker/?aid=24149Issue Tracking, Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.