CVSS: 7.2EPSS: 0%CPEs: 3EXPL: 0CVE-2021-43782 – Indirect LDAP injection in Tuleap
https://notcve.org/view.php?id=CVE-2021-43782
Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. This is a follow up to GHSA-887w-pv2r-x8pm/CVE-2021-41276, the initial fix was incomplete. Tuleap does not sanitize properly the search filter built from the ldap_id attribute of a user during the daily synchronization. A malicious user could force accounts to be suspended or take over another account by forcing the update of the ldap_uid attribute. Note that the malicious user either need to have site administrator capability on the Tuleap instance or be an LDAP operator with the capability to create/modify account. • https://github.com/Enalean/tuleap/commit/64e77561eba9f8233199c2962b3497ed7294a7d2 https://github.com/Enalean/tuleap/security/advisories/GHSA-887w-pv2r-x8pm https://github.com/Enalean/tuleap/security/advisories/GHSA-cwv9-hhm4-jr84 https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=64e77561eba9f8233199c2962b3497ed7294a7d2 https://tuleap.net/plugins/tracker/?aid=24168 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 0CVE-2021-41142 – XSS via the name of a deleted attachment
https://notcve.org/view.php?id=CVE-2021-41142
Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. There is a cross-site scripting vulnerability in Tuleap Community Edition prior to 12.11.99.25 and Tuleap Enterprise Edition 12.11-2. A malicious user with the capability to add and remove attachment to an artifact could force a victim to execute uncontrolled code. Tuleap Community Edition 11.17.99.146 and Tuleap Enterprise Edition 12.11-2 contain a fix for the issue. Tuleap Open ALM es una herramienta libre y de código abierto para la trazabilidad de extremo a extremo de los desarrollos de aplicaciones y sistemas. • https://github.com/Enalean/tuleap/commit/d6c837ed6fa66d319175954a42f93d4d86745208 https://github.com/Enalean/tuleap/security/advisories/GHSA-p3j6-6h9h-34r5 https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=d6c837ed6fa66d319175954a42f93d4d86745208 https://tuleap.net/plugins/tracker/?aid=22570 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •