CVE-2021-41154— SQL injection in the "SVN core" commits browser

Quick assessment

Copy summary Copy citation

Affected

Enalean tuleap

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Enalean Tuleap Open Alm是法国Enalean公司的一个自由的开源工具。用于应用程序和系统开发的端到端可追溯性。 Tuleap Open Alm 中存在SQL注入漏洞，在受影响的版本中，对SVN 核心存储库具有读取访问权限的攻击者可以执行任意 SQL 查询。以下版本包含此修复程序：Tuleap Community Edition 11.17.99.144、Tuleap Enterprise Edition 11.17-5、Tuleap Enterprise Edition 11.16-

CVE-2021-41154 affects Enalean tuleap. No confirmed in-the-wild exploitation; assess based on exposure. Enalean Tuleap Open Alm是法国Enalean公司的一个自由的开源工具。用于应用程序和系统开发的端到端可追溯性。 Tuleap Open Alm 中存在SQL注入漏洞，在受影响的版本中，对SVN 核心存储库具有读取访问权限的攻击者可以执行任意 SQL 查询。以下版本包含此修复程序：Tuleap Community Edition 11.1 CVE-2021-41154 vulnerability details, Shenlong CVE Platform, https://cve.imfht.com/detail/CVE-2021-41154

I. Basic Information for CVE-2021-41154

Affected Products

II. Public POCs for CVE-2021-41154

III. Intelligence Information for CVE-2021-41154

Patches & Fixes for CVE-2021-41154 (1)

• https://github.com/Enalean/tuleap/commit/ab12b686ced4cf233d3b15b08da008e0553eb6a6 x_refsource_MISC

Vendor Advisories for CVE-2021-41154 (1)

• https://github.com/Enalean/tuleap/security/advisories/GHSA-6462-gfv9-jf83 x_refsource_CONFIRM

Other References for CVE-2021-41154 (1)

• https://tuleap.net/plugins/tracker/?aid=16213 x_refsource_MISC

• https://www.cve.org/CVERecord?id=CVE-2021-41154

IV. Related Vulnerabilities

V. Comments for CVE-2021-41154