CVE-2017-7411: Code Injection
An issue was discovered in Enalean Tuleap 9.6 and prior versions. The vulnerability exists because the User::getRecentElements() method is using the unserialize() function with a preference value that can be arbitrarily manipulated by malicious users through the REST API interface, and this can be exploited to inject arbitrary PHP objects into the application scope, allowing an attacker to perform a variety of attacks (including but not limited to Remote Code Execution).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7411?
CVE-2017-7411 has been classified as a high severity vulnerability due to its potential for exploitation by malicious users.
How do I fix CVE-2017-7411?
To fix CVE-2017-7411, you should upgrade to the latest version of Enalean Tuleap that addresses this vulnerability.
What type of vulnerability is CVE-2017-7411?
CVE-2017-7411 is a second order PHP object injection vulnerability that affects the REST API interface.
Who is affected by CVE-2017-7411?
CVE-2017-7411 affects all versions of Enalean Tuleap up to and including version 9.6.
How does CVE-2017-7411 allow exploitation?
CVE-2017-7411 allows exploitation by enabling attackers to manipulate the unserialize() function through the User::getRecentElements() method.