CVE-2022-31058

Опубликовано: 29 июн. 2022

Источник: nvd

CVSS3: 7.2

CVSS2: 6.5

EPSS Низкий

Описание

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.95 Tuleap does not sanitize properly user inputs when constructing the SQL query to retrieve data for the tracker reports. An attacker with the capability to create a new tracker can execute arbitrary SQL queries. Users are advised to upgrade. There is no known workaround for this issue.

Ссылки

https://github.com/Enalean/tuleap/commit/b91bcd57c8344ec2a4c1833629e400cef4dd901a
Patch
Third Party Advisory
https://github.com/Enalean/tuleap/security/advisories/GHSA-4v2p-rwq9-3vjf
Third Party Advisory
https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=b91bcd57c8344ec2a4c1833629e400cef4dd901a
Patch
Vendor Advisory
https://tuleap.net/plugins/tracker/?aid=27172
Issue Tracking
Vendor Advisory
https://github.com/Enalean/tuleap/commit/b91bcd57c8344ec2a4c1833629e400cef4dd901a
Patch
Third Party Advisory
https://github.com/Enalean/tuleap/security/advisories/GHSA-4v2p-rwq9-3vjf
Third Party Advisory
https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=b91bcd57c8344ec2a4c1833629e400cef4dd901a
Patch
Vendor Advisory
https://tuleap.net/plugins/tracker/?aid=27172
Issue Tracking
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:*

Версия до 13.9.99.111 (исключая)

cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*

Версия от 13.8.0 (включая) до 13.8.6 (исключая)

cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*

Версия от 13.9.0 (включая) до 13.9.3 (исключая)

EPSS

Процентиль: 80%

0.01344

Низкий

7.2 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-89