Vulnerability Description
Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. In affected versions Tuleap does not sanitize properly user settings when constructing the SQL query to browse and search commits in the CVS repositories. A authenticated malicious user with read access to a CVS repository could execute arbitrary SQL queries. Tuleap instances without an active CVS repositories are not impacted. The following versions contain the fix: Tuleap Community Edition 13.2.99.155, Tuleap Enterprise Edition 13.1-7, and Tuleap Enterprise Edition 13.2-6.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Enalean | Tuleap | < 13.2.99.155 |
Related Weaknesses (CWE)
References
- https://github.com/Enalean/tuleap/commit/b82be896b00a787ed46a77bd4700e8fccfe2e5bPatchThird Party Advisory
- https://github.com/Enalean/tuleap/security/advisories/GHSA-x8fr-8gvw-cc4vPatchThird Party Advisory
- https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=b82be896b00a787edPatchVendor Advisory
- https://tuleap.net/plugins/tracker/?aid=24202Issue TrackingPatchVendor Advisory
- https://github.com/Enalean/tuleap/commit/b82be896b00a787ed46a77bd4700e8fccfe2e5bPatchThird Party Advisory
- https://github.com/Enalean/tuleap/security/advisories/GHSA-x8fr-8gvw-cc4vPatchThird Party Advisory
- https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=b82be896b00a787edPatchVendor Advisory
- https://tuleap.net/plugins/tracker/?aid=24202Issue TrackingPatchVendor Advisory
FAQ
What is CVE-2021-43806?
CVE-2021-43806 is a vulnerability with a CVSS score of 8.8 (HIGH). Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. In affected versions Tuleap does not sanitize properly user settings when constructing the SQ...
How severe is CVE-2021-43806?
CVE-2021-43806 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-43806?
Check the references section above for vendor advisories and patch information. Affected products include: Enalean Tuleap.