PT-2021-23134 · Svn Core+1 · Svn Core+2

Tgerbet + 1 · Published 2021-10-18 · Updated 2021-10-22 · CVE-2021-41154

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tuleap Community Edition versions prior to 11.17.99.144 Tuleap Enterprise Edition versions prior to 11.17-5 Tuleap Enterprise Edition versions prior to 11.16-7

Description The issue allows an attacker with read access to a "SVN core" repository to execute arbitrary SQL queries, potentially leading to unauthorized data access or modification.

Recommendations For Tuleap Community Edition versions prior to 11.17.99.144, update to version 11.17.99.144 or later. For Tuleap Enterprise Edition versions prior to 11.17-5, update to version 11.17-5 or later. For Tuleap Enterprise Edition versions prior to 11.16-7, update to version 11.16-7 or later.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-41154

GHSA-6462-GFV9-JF83

Affected Products

Svn Core

Tuleap Community Edition

Tuleap Enterprise Edition

References · 7

• https://github.com/Enalean/tuleap/commit/ab12b686ced4cf233d3b15b08da008e0553eb6a6 · Patch
• https://tuleap.net/plugins/tracker/?aid=16213 · Vendor Advisory
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=ab12b686ced4cf233d3b15b08da008e0553eb6a6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41154 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41154 · Security Note
• https://github.com/Enalean/tuleap/security/advisories/GHSA-6462-gfv9-jf83 · Note
• https://t.me/cibsecurity/30743 · Telegram Post