CVE-2021-43806: SQL injection in Tuleap
First published: Wed Dec 15 2021(Updated: )
Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. In affected versions Tuleap does not sanitize properly user settings when constructing the SQL query to browse and search commits in the CVS repositories. A authenticated malicious user with read access to a CVS repository could execute arbitrary SQL queries. Tuleap instances without an active CVS repositories are not impacted. The following versions contain the fix: Tuleap Community Edition 13.2.99.155, Tuleap Enterprise Edition 13.1-7, and Tuleap Enterprise Edition 13.2-6.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Enalean Tuleap | <13.2.99.155 | |
| Enalean Tuleap | >=13.1-1<13.1-7 | |
| Enalean Tuleap | >=13.2-1<13.2-6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/Enalean/tuleap/commit/b82be896b00a787ed46a77bd4700e8fccfe2e5ba
- https://github.com/Enalean/tuleap/security/advisories/GHSA-x8fr-8gvw-cc4v
- https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=b82be896b00a787ed46a77bd4700e8fccfe2e5ba
- https://tuleap.net/plugins/tracker/?aid=24202
Frequently Asked Questions
What is CVE-2021-43806?
CVE-2021-43806 is a vulnerability in Tuleap, an open-source tool for traceability of application and system developments.
What is the severity of CVE-2021-43806?
The severity of CVE-2021-43806 is high with a CVSS score of 8.8.
How does CVE-2021-43806 affect Tuleap?
CVE-2021-43806 affects Tuleap by not properly sanitizing user settings when constructing SQL queries for browsing and searching commits in CVS repositories.
Who is affected by CVE-2021-43806?
Users of Tuleap versions up to 13.2.99.155 (Community Edition) and versions 13.1-1 to 13.1-7 (Enterprise Edition) and versions 13.2-1 to 13.2-6 (Enterprise Edition) are affected by CVE-2021-43806.
How can CVE-2021-43806 be fixed?
To fix CVE-2021-43806, users should update their Tuleap installation to a version that includes the patch for this vulnerability.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/weakness
- agent/last-modified-date
- agent/title
- agent/first-publish-date
- agent/tags
- agent/description
- agent/event
- vendor/enalean
- canonical/enalean tuleap
- version/enalean tuleap/13.1-1
- version/enalean tuleap/13.2-1