CVE-2022-31058
High
Description
Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.95 Tuleap does not sanitize properly user inputs when constructing the SQL query to retrieve data for the tracker reports. An attacker with the capability to create a new tracker can execute arbitrary SQL queries. Users are advised to upgrade. There is no known workaround for this issue.
SeverityHigh
CVSS7.2
Exploit probability—
ProductEnalean Tuleap
PublishedJun 29, 2022
First seenJun 29, 2022
Weakness typeCWE-89SQL injection
How to fix
Update
- enalean tuleap13.9.99.111, 13.8.6, 13.9.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| enalean tuleap | v < 13.9.99.111, 13.8.0 ≤ v < 13.8.6, 13.9.0 ≤ v < 13.9.3 | 13.9.99.111, 13.8.6, 13.9.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.