Tuleap Enterprise Edition
Monthly
SQL injection in Tuleap Enterprise Edition 17.5 allows an authenticated attacker with only low-level privileges to inject arbitrary SQL and gain read access to the underlying Tuleap database, with the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, 7.1) indicating high confidentiality impact but no integrity or full availability loss. Because exploitation requires a valid session (PR:L) and no user interaction, the practical risk is concentrated in internet-facing or broadly provisioned instances rather than being an emergency for every deployment; there is no public exploit identified at time of analysis and no confirmed active exploitation. This is a credible but moderate-priority issue whose urgency depends on how freely accounts can be obtained on the affected instance.
Authorization bypass in Tuleap Enterprise Edition 17.0 through 17.5 allows an authenticated attacker who already holds tracker administration rights on one tracker to update or delete fields belonging to other trackers on the same instance. The flaw is a CWE-639 user-controlled key authorization bypass rated CVSS 8.1 with high integrity and availability impact, but it requires a low-privilege tracker-admin role (PR:L) and affects only the stated versions. No public exploit identified at time of analysis, and no confirmed active exploitation, though practical risk is highest in large multi-team deployments where many trackers share one instance.
Stored cross-site scripting in Tuleap Enterprise Edition 17.0 through 17.5 allows an attacker holding a low-privileged authenticated account to persist arbitrary script into content that is later rendered in another user's browser, where it executes within that victim's authenticated session (CVSS 3.1 base 8.7, scope-changed). Exploitation is not unilateral: it requires a valid account with enough privilege to submit persistent content into a field shown to other users (PR:L) plus a victim who views the poisoned content (UI:R), so practical severity depends on how many users - and how privileged those users - can be induced to open the crafted page. No public exploit identified at time of analysis, and no EPSS or CISA KEV corroboration of active exploitation was supplied with the intelligence.
Stored cross-site scripting in Tuleap Enterprise Edition 17.0 through 17.5 allows an authenticated user with only low privileges to persist malicious script content into application fields, which then executes in the browser session of any other user who views the poisoned page. Because the payload is stored rather than reflected, a single injection can fire repeatedly against multiple victims, including higher-privileged users, and the CVSS scope change (S:C) reflects that the script runs with the privileges of the victim's origin rather than the attacker's account. Exploitation requires valid credentials (PR:L) and victim interaction (UI:R), and no public exploit code was identified at time of analysis; no EPSS score, CISA KEV entry, or active-exploitation reporting was provided in the available intelligence.
Stored cross-site scripting (XSS) in Tuleap Enterprise Edition 17.0 through 17.5 allows an authenticated attacker to inject malicious script into a persisted field, which then executes in the browser session of any user who views the affected content. The vulnerability requires a low-privileged account (PR:L) and user interaction (UI:R) from a victim, and can lead to high confidentiality and integrity impact. No public exploit identified at time of analysis.
OS command injection in Tuleap Enterprise Edition versions 17.0 through 17.5 allows an authenticated, low-privilege user to execute arbitrary commands on the underlying server, delivering a full compromise of confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because the assessed vector specifies PR:L, exploitation requires a valid account on the target instance - a registered project or site user is sufficient - and no user interaction is needed once that access is obtained, so unauthenticated attackers cannot trigger it directly. No public exploit code was identified at time of analysis and the CVE is not listed in CISA KEV; no EPSS score was supplied in the source data. Practical risk is therefore concentrated on internet-reachable Tuleap Enterprise Edition instances in the 17.0-17.5 range that allow self-registration or broad account provisioning, since such deployments effectively lower the credential barrier to exploitation.
OS command injection in Dassault Systèmes Tuleap Enterprise Edition versions 17.3 through 17.5 allows an authenticated remote attacker with a low-privilege account to execute arbitrary operating system commands on the server, as indicated by CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H and a base score of 8.8. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the potential for full server compromise makes this a genuine high-priority issue that is not a drop-everything emergency. Instances are only affected if they run versions 17.3-17.5 and permit low-privilege authenticated access, so environments with tightly controlled account provisioning or network restrictions face reduced exposure.
The XML import feature in Tuleap Enterprise Edition versions 17.0 through 17.5 assigns default passwords to user accounts created during XML import operations (CWE-1393), exposing those accounts to network-accessible credential guessing with no authentication or user interaction required. Successful exploitation grants an attacker full control of an affected user account, resulting in high confidentiality and integrity impact per the CVSS 7.7 score. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV, but the unauthenticated network vector makes this a realistic threat for any organization that has used XML import for bulk user migration.
Insecure direct object reference (IDOR) in Dassault Systèmes Tuleap Enterprise Edition 17.0 through 17.5 lets attackers read other users' data by manipulating a user-controlled key/identifier, breaking horizontal authorization boundaries. The CVSS 3.1 vector (AV:N/PR:N) scores it as remotely reachable with high confidentiality impact but no integrity or availability effect. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
SQL injection in Tuleap Enterprise Edition 17.5 allows an authenticated attacker with only low-level privileges to inject arbitrary SQL and gain read access to the underlying Tuleap database, with the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, 7.1) indicating high confidentiality impact but no integrity or full availability loss. Because exploitation requires a valid session (PR:L) and no user interaction, the practical risk is concentrated in internet-facing or broadly provisioned instances rather than being an emergency for every deployment; there is no public exploit identified at time of analysis and no confirmed active exploitation. This is a credible but moderate-priority issue whose urgency depends on how freely accounts can be obtained on the affected instance.
Authorization bypass in Tuleap Enterprise Edition 17.0 through 17.5 allows an authenticated attacker who already holds tracker administration rights on one tracker to update or delete fields belonging to other trackers on the same instance. The flaw is a CWE-639 user-controlled key authorization bypass rated CVSS 8.1 with high integrity and availability impact, but it requires a low-privilege tracker-admin role (PR:L) and affects only the stated versions. No public exploit identified at time of analysis, and no confirmed active exploitation, though practical risk is highest in large multi-team deployments where many trackers share one instance.
Stored cross-site scripting in Tuleap Enterprise Edition 17.0 through 17.5 allows an attacker holding a low-privileged authenticated account to persist arbitrary script into content that is later rendered in another user's browser, where it executes within that victim's authenticated session (CVSS 3.1 base 8.7, scope-changed). Exploitation is not unilateral: it requires a valid account with enough privilege to submit persistent content into a field shown to other users (PR:L) plus a victim who views the poisoned content (UI:R), so practical severity depends on how many users - and how privileged those users - can be induced to open the crafted page. No public exploit identified at time of analysis, and no EPSS or CISA KEV corroboration of active exploitation was supplied with the intelligence.
Stored cross-site scripting in Tuleap Enterprise Edition 17.0 through 17.5 allows an authenticated user with only low privileges to persist malicious script content into application fields, which then executes in the browser session of any other user who views the poisoned page. Because the payload is stored rather than reflected, a single injection can fire repeatedly against multiple victims, including higher-privileged users, and the CVSS scope change (S:C) reflects that the script runs with the privileges of the victim's origin rather than the attacker's account. Exploitation requires valid credentials (PR:L) and victim interaction (UI:R), and no public exploit code was identified at time of analysis; no EPSS score, CISA KEV entry, or active-exploitation reporting was provided in the available intelligence.
Stored cross-site scripting (XSS) in Tuleap Enterprise Edition 17.0 through 17.5 allows an authenticated attacker to inject malicious script into a persisted field, which then executes in the browser session of any user who views the affected content. The vulnerability requires a low-privileged account (PR:L) and user interaction (UI:R) from a victim, and can lead to high confidentiality and integrity impact. No public exploit identified at time of analysis.
OS command injection in Tuleap Enterprise Edition versions 17.0 through 17.5 allows an authenticated, low-privilege user to execute arbitrary commands on the underlying server, delivering a full compromise of confidentiality, integrity, and availability (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because the assessed vector specifies PR:L, exploitation requires a valid account on the target instance - a registered project or site user is sufficient - and no user interaction is needed once that access is obtained, so unauthenticated attackers cannot trigger it directly. No public exploit code was identified at time of analysis and the CVE is not listed in CISA KEV; no EPSS score was supplied in the source data. Practical risk is therefore concentrated on internet-reachable Tuleap Enterprise Edition instances in the 17.0-17.5 range that allow self-registration or broad account provisioning, since such deployments effectively lower the credential barrier to exploitation.
OS command injection in Dassault Systèmes Tuleap Enterprise Edition versions 17.3 through 17.5 allows an authenticated remote attacker with a low-privilege account to execute arbitrary operating system commands on the server, as indicated by CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H and a base score of 8.8. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the potential for full server compromise makes this a genuine high-priority issue that is not a drop-everything emergency. Instances are only affected if they run versions 17.3-17.5 and permit low-privilege authenticated access, so environments with tightly controlled account provisioning or network restrictions face reduced exposure.
The XML import feature in Tuleap Enterprise Edition versions 17.0 through 17.5 assigns default passwords to user accounts created during XML import operations (CWE-1393), exposing those accounts to network-accessible credential guessing with no authentication or user interaction required. Successful exploitation grants an attacker full control of an affected user account, resulting in high confidentiality and integrity impact per the CVSS 7.7 score. No public exploit code has been identified at time of analysis and this CVE is not listed in CISA KEV, but the unauthenticated network vector makes this a realistic threat for any organization that has used XML import for bulk user migration.
Insecure direct object reference (IDOR) in Dassault Systèmes Tuleap Enterprise Edition 17.0 through 17.5 lets attackers read other users' data by manipulating a user-controlled key/identifier, breaking horizontal authorization boundaries. The CVSS 3.1 vector (AV:N/PR:N) scores it as remotely reachable with high confidentiality impact but no integrity or availability effect. No public exploit identified at time of analysis, and it is not listed in CISA KEV.