CVE-2014-8791: Code Injection
project/register.php in Tuleap before 7.7, when syscreateprojectinonestep is disabled, allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via the data parameter.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-8791?
CVE-2014-8791 is considered a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2014-8791?
To fix CVE-2014-8791, upgrade Tuleap to version 7.7 or later where the vulnerability has been addressed.
Who is affected by CVE-2014-8791?
CVE-2014-8791 affects authenticated users of Tuleap version 7.6 and prior who can exploit the vulnerable parameter.
What types of attacks can CVE-2014-8791 facilitate?
CVE-2014-8791 can facilitate PHP object injection attacks, potentially leading to arbitrary code execution.
Is CVE-2014-8791 still a concern for unpatched installations?
Yes, CVE-2014-8791 remains a significant concern for unpatched installations of Tuleap version 7.6 or earlier.