CVE-2021-41154 - Vulnerability Details - OpenCVE

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected versions an attacker with read access to a "SVN core" repository could execute arbitrary SQL queries. The following versions contain the fix: Tuleap Community Edition 11.17.99.144, Tuleap Enterprise Edition 11.17-5, Tuleap Enterprise Edition 11.16-7.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Enalean	Tuleap

Configuration 1 [-]

OR	cpe:2.3:a:enalean:tuleap:::::community:::*
	cpe:2.3:a:enalean:tuleap:::::enterprise:::*
	cpe:2.3:a:enalean:tuleap:::::enterprise:::*

No data.

References

Link	Providers
https://github.com/Enalean/tuleap/commit/ab12b686ced4cf233d3b15b08da008e0553eb6a6
https://github.com/Enalean/tuleap/security/advisories/GHSA-6462-gfv9-jf83
https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=ab12b686ced4cf233d3b15b08da008e0553eb6a6
https://tuleap.net/plugins/tracker/?aid=16213

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2021-10-18T21:10:27

Updated: 2024-08-04T02:59:31.584Z

Reserved: 2021-09-15T00:00:00

Link: CVE-2021-41154

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-10-18T22:15:07.617

Modified: 2024-11-21T06:25:36.873

Link: CVE-2021-41154

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "tuleap", "vendor": "Enalean", "versions": [{"status": "affected", "version": "< 11.17.99.144"}, {"status": "affected", "version": ">= 11.17-1, < 11.17-5"}, {"status": "affected", "version": ">= 11.16-1, < 11.16-7"}]}], "descriptions": [{"lang": "en", "value": "Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected versions an attacker with read access to a \"SVN core\" repository could execute arbitrary SQL queries. The following versions contain the fix: Tuleap Community Edition 11.17.99.144, Tuleap Enterprise Edition 11.17-5, Tuleap Enterprise Edition 11.16-7."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-10-18T21:10:27", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Enalean/tuleap/security/advisories/GHSA-6462-gfv9-jf83"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/Enalean/tuleap/commit/ab12b686ced4cf233d3b15b08da008e0553eb6a6"}, {"tags": ["x_refsource_MISC"], "url": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=ab12b686ced4cf233d3b15b08da008e0553eb6a6"}, {"tags": ["x_refsource_MISC"], "url": "https://tuleap.net/plugins/tracker/?aid=16213"}], "source": {"advisory": "GHSA-6462-gfv9-jf83", "discovery": "UNKNOWN"}, "title": "SQL injection in the \"SVN core\" commits browser", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2021-41154", "STATE": "PUBLIC", "TITLE": "SQL injection in the \"SVN core\" commits browser"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "tuleap", "version": {"version_data": [{"version_value": "< 11.17.99.144"}, {"version_value": ">= 11.17-1, < 11.17-5"}, {"version_value": ">= 11.16-1, < 11.16-7"}]}}]}, "vendor_name": "Enalean"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected versions an attacker with read access to a \"SVN core\" repository could execute arbitrary SQL queries. The following versions contain the fix: Tuleap Community Edition 11.17.99.144, Tuleap Enterprise Edition 11.17-5, Tuleap Enterprise Edition 11.16-7."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}]}, "references": {"reference_data": [{"name": "https://github.com/Enalean/tuleap/security/advisories/GHSA-6462-gfv9-jf83", "refsource": "CONFIRM", "url": "https://github.com/Enalean/tuleap/security/advisories/GHSA-6462-gfv9-jf83"}, {"name": "https://github.com/Enalean/tuleap/commit/ab12b686ced4cf233d3b15b08da008e0553eb6a6", "refsource": "MISC", "url": "https://github.com/Enalean/tuleap/commit/ab12b686ced4cf233d3b15b08da008e0553eb6a6"}, {"name": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=ab12b686ced4cf233d3b15b08da008e0553eb6a6", "refsource": "MISC", "url": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=ab12b686ced4cf233d3b15b08da008e0553eb6a6"}, {"name": "https://tuleap.net/plugins/tracker/?aid=16213", "refsource": "MISC", "url": "https://tuleap.net/plugins/tracker/?aid=16213"}]}, "source": {"advisory": "GHSA-6462-gfv9-jf83", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T02:59:31.584Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/Enalean/tuleap/security/advisories/GHSA-6462-gfv9-jf83"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/Enalean/tuleap/commit/ab12b686ced4cf233d3b15b08da008e0553eb6a6"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=ab12b686ced4cf233d3b15b08da008e0553eb6a6"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://tuleap.net/plugins/tracker/?aid=16213"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2021-41154", "datePublished": "2021-10-18T21:10:27", "dateReserved": "2021-09-15T00:00:00", "dateUpdated": "2024-08-04T02:59:31.584Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:*", "matchCriteriaId": "3772A5E9-DB3F-4862-A561-6E2B9D4657E6", "versionEndExcluding": "11.17.99.144", "vulnerable": true}, {"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "C729636A-A29A-4C71-8AF0-CF531D309B9F", "versionEndExcluding": "11.16-7", "versionStartIncluding": "11.16-1", "vulnerable": true}, {"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "0B68A044-63C9-493C-B315-E50EB4ECAC1C", "versionEndExcluding": "11.17-5", "versionStartIncluding": "11.17-1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected versions an attacker with read access to a \"SVN core\" repository could execute arbitrary SQL queries. The following versions contain the fix: Tuleap Community Edition 11.17.99.144, Tuleap Enterprise Edition 11.17-5, Tuleap Enterprise Edition 11.16-7."}, {"lang": "es", "value": "Tuleap es una Suite Libre y de C\u00f3digo Abierto para mejorar la administraci\u00f3n de desarrolladores de software y colaboraci\u00f3n. En las versiones afectadas un atacante con acceso de lectura a un repositorio \"SVN core\" podr\u00eda ejecutar consultas SQL arbitrarias. Las siguientes versiones contienen la correcci\u00f3n: Tuleap Community Edition versi\u00f3n 11.17.99.144, Tuleap Enterprise Edition versi\u00f3n 11.17-5, Tuleap Enterprise Edition versi\u00f3n 11.16-7"}], "id": "CVE-2021-41154", "lastModified": "2024-11-21T06:25:36.873", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-10-18T22:15:07.617", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/Enalean/tuleap/commit/ab12b686ced4cf233d3b15b08da008e0553eb6a6"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/Enalean/tuleap/security/advisories/GHSA-6462-gfv9-jf83"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=ab12b686ced4cf233d3b15b08da008e0553eb6a6"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://tuleap.net/plugins/tracker/?aid=16213"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/Enalean/tuleap/commit/ab12b686ced4cf233d3b15b08da008e0553eb6a6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/Enalean/tuleap/security/advisories/GHSA-6462-gfv9-jf83"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=ab12b686ced4cf233d3b15b08da008e0553eb6a6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://tuleap.net/plugins/tracker/?aid=16213"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Primary"}]}