CVE-2021-41142
Medium
Description
Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. There is a cross-site scripting vulnerability in Tuleap Community Edition prior to 12.11.99.25 and Tuleap Enterprise Edition 12.11-2. A malicious user with the capability to add and remove attachment to an artifact could force a victim to execute uncontrolled code. Tuleap Community Edition 11.17.99.146 and Tuleap Enterprise Edition 12.11-2 contain a fix for the issue.
SeverityMedium
CVSS5.4
Exploit probability—
ProductEnalean Tuleap
PublishedOct 14, 2021
First seenOct 14, 2021
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- enalean tuleap11.17.99.146, 12.11-2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| enalean tuleap | v < 11.17.99.146, v < 12.11-2 | 11.17.99.146, 12.11-2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.