SQL injection in the "SVN core" commits browser
CVE-2021-41154

8.8HIGH

Key Information:

Vendor

Enalean

Status
Tuleap
Vendor
CVE Published:
18 October 2021

What is CVE-2021-41154?

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected versions an attacker with read access to a "SVN core" repository could execute arbitrary SQL queries. The following versions contain the fix: Tuleap Community Edition 11.17.99.144, Tuleap Enterprise Edition 11.17-5, Tuleap Enterprise Edition 11.16-7.

Affected Version(s)

tuleap < 11.17.99.144 < 11.17.99.144

tuleap >= 11.17-1, < 11.17-5 < 11.17-1, 11.17-5

tuleap >= 11.16-1, < 11.16-7 < 11.16-1, 11.16-7

References

https://github.com/Enalean/tuleap/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/Enalean/tuleap/commit/ab12b686ced4cf23...
x_refsource_MISC
https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=com...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2021-41154 : SQL injection in the "SVN core" commits browser