CVE-2021-41155CWE-89

SQL injection in CVS revisions browser

High · published October 18, 2021

CVSS v3.1
8.8
EPSS
2%
Percentile
74.5
In the wild
Unconfirmed
What it is

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected versions Tuleap does not sanitize properly user inputs when constructing the SQL query to browse and search revisions in the CVS repositories. The following versions contain the fix: Tuleap Community Edition 11.17.99.146, Tuleap Enterprise Edition 11.17-5, Tuleap Enterprise Edition 11.16-7.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01527 · 74.5th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2021-10-18T21:10Z
EPSS history
Timeline
  • 18 OCT 21:10Z
    SQL injection in CVS revisions browser
    cvelistv5