HIGH🇵🇱 Wersja polska

CVE-2022-31058

CVSS 7.2v3.1pub. 2022-06-29upd. 2024-11-21

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.95 Tuleap does not sanitize properly user inputs when constructing the SQL query to retrieve data for the tracker reports. An attacker with the capability to create a new tracker can execute arbitrary SQL queries. Users are advised to upgrade. There is no known workaround for this issue.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

  • Enalean Tuleap

    APP
    Enalean
    < 13.9.99.11113.8.0 – 13.8.6 (excl.)13.9.0 – 13.9.3 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
SQLi
CWE
References

Related vulnerabilities

CVE-2018-17298CRITICAL9.8PL ✓same product

Enalean Tuleap: linki reset hasła nie są unieważniane po zmianie hasła

CVE-2018-7538CRITICAL9.8PL ✓same product

SQL Injection w module tracker platformy Enalean Tuleap

CVE-2024-30246HIGH7.6same product

Tuleap is an Open Source Suite to improve management of software developments and collaboration. A malicious u...

CVE-2021-43806HIGH8.8same product

Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. In ...

CVE-2021-41154HIGH8.8same product

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affe...