CVE-2022-31058: SQL injection via the field name of a tracker in Tuleap
First published: Wed Jun 29 2022(Updated: )
Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.95 Tuleap does not sanitize properly user inputs when constructing the SQL query to retrieve data for the tracker reports. An attacker with the capability to create a new tracker can execute arbitrary SQL queries. Users are advised to upgrade. There is no known workaround for this issue.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Enalean Tuleap | <13.9.99.111 | |
| Enalean Tuleap | >=13.8.0<13.8.6 | |
| Enalean Tuleap | >=13.9.0<13.9.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/Enalean/tuleap/commit/b91bcd57c8344ec2a4c1833629e400cef4dd901a
- https://github.com/Enalean/tuleap/security/advisories/GHSA-4v2p-rwq9-3vjf
- https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=b91bcd57c8344ec2a4c1833629e400cef4dd901a
- https://tuleap.net/plugins/tracker/?aid=27172
Frequently Asked Questions
What is CVE-2022-31058?
CVE-2022-31058 is a vulnerability in Tuleap that allows an attacker to execute arbitrary SQL queries.
What is the severity of CVE-2022-31058?
CVE-2022-31058 has a severity rating of 7.2 (high).
How does CVE-2022-31058 impact Tuleap?
CVE-2022-31058 allows an attacker to manipulate SQL queries and retrieve sensitive data from Tuleap.
Is there a fix available for CVE-2022-31058?
Yes, a fix is available for CVE-2022-31058. Users should update to version 13.9.99.95 or later of Tuleap.
Where can I find more information about CVE-2022-31058?
You can find more information about CVE-2022-31058 in the official Tuleap security advisory and the GitHub commit.
- collector/nvd-index
- agent/references
- agent/remedy
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/title
- agent/description
- agent/event
- agent/first-publish-date
- vendor/enalean
- canonical/enalean tuleap
- version/enalean tuleap/13.8.0
- version/enalean tuleap/13.9.0