CVE-2017-7981: OS Command Injection
Tuleap before 9.7 allows command injection via the PhpWiki 1.3.10 SyntaxHighlighter plugin. This occurs in the Project Wiki component because the procopen PHP function is used within PhpWiki before 1.5.5 with a syntax value in its first argument, and an authenticated Tuleap user can control this value, even with shell metacharacters, as demonstrated by a '<?plugin SyntaxHighlighter syntax="c;id"' line to execute the id command.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7981?
CVE-2017-7981 is classified as a medium severity vulnerability due to its potential for command injection.
How do I fix CVE-2017-7981?
To fix CVE-2017-7981, upgrade Tuleap to version 9.7 or later and ensure PhpWiki is updated to version 1.5.5 or higher.
What systems are affected by CVE-2017-7981?
CVE-2017-7981 affects Tuleap versions prior to 9.7 and PhpWiki version 1.3.10.
Who can exploit CVE-2017-7981?
Authenticated Tuleap users can exploit CVE-2017-7981 due to the command injection vulnerability.
What is the impact of CVE-2017-7981?
The impact of CVE-2017-7981 includes the ability to execute arbitrary commands on the server, potentially compromising system integrity.