PT-2014-7817 · Enalean · Tuleap

Published 2014-11-28 · Updated 2014-12-17 · CVE-2014-7178

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Enalean Tuleap versions prior to 7.5.99.6

Description The issue allows remote attackers to execute arbitrary commands. This is achieved by manipulating the User-Agent header, which is then provided to the passthru PHP function.

Recommendations For versions prior to 7.5.99.6, update to version 7.5.99.6 or later to resolve the issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2014-7178

Affected Products

Tuleap

References · 5

• 🔥 https://portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-7178 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2014/Oct/121 · Exploit
• 🔥 https://exploit-db.com/exploits/35100 · Exploit
• https://tuleap.org/recent-vulnerabilities · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-7178 · Security Note