CVE-2021-41142

moderate-risk
Published 2021-10-14

Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. There is a cross-site scripting vulnerability in Tuleap Community Edition prior to 12.11.99.25 and Tuleap Enterprise Edition 12.11-2. A malicious user with the capability to add and remove attachment to an artifact could force a victim to execute uncontrolled code. Tuleap Community Edition 11.17.99.146 and Tuleap Enterprise Edition 12.11-2 contain a fix for the issue.

Do I need to act?

-
0.44% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.4/10 Medium
NETWORK / LOW complexity

Affected Products (2)

Affected Vendors

Enalean

References (8)

Patch https://github.com/Enalean/tuleap/commit/d6c837ed6fa66d319175954a42f93d4d8674520...
Patch https://github.com/Enalean/tuleap/security/advisories/GHSA-p3j6-6h9h-34r5
Patch https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=d6c837ed6fa66d319...
Vendor Advisory https://tuleap.net/plugins/tracker/?aid=22570
Patch https://github.com/Enalean/tuleap/commit/d6c837ed6fa66d319175954a42f93d4d8674520...
Patch https://github.com/Enalean/tuleap/security/advisories/GHSA-p3j6-6h9h-34r5
Patch https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=d6c837ed6fa66d319...
Vendor Advisory https://tuleap.net/plugins/tracker/?aid=22570
30
/ 100
moderate-risk
Severity 21/34 · High
Exploitability 2/34 · Minimal
Exposure 7/34 · Low