CVE-2021-41155

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected versions Tuleap does not sanitize properly user inputs when constructing the SQL query to browse and search revisions in the CVS repositories. The following versions contain the fix: Tuleap Community Edition 11.17.99.146, Tuleap Enterprise Edition 11.17-5, Tuleap Enterprise Edition 11.16-7.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Enalean	tuleap	< 11.17.99.146; >= 11.17-1, < 11.17-5; >= 11.16-1, < 11.16-7

References

https://github.com/Enalean/tuleap/commit/ff75f2899c60a4546ee2d532e68a3febd07bdd14Patch, Third Party Advisory
https://github.com/Enalean/tuleap/security/advisories/GHSA-f8jp-hx4q-wxvrPatch, Third Party Advisory
https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=ff75f2899c60a4546ee2d532e68a3febd07bdd14Patch, Vendor Advisory
https://tuleap.net/plugins/tracker/?aid=16214Vendor Advisory
https://github.com/Enalean/tuleap/commit/ff75f2899c60a4546ee2d532e68a3febd07bdd14Patch, Third Party Advisory
https://github.com/Enalean/tuleap/security/advisories/GHSA-f8jp-hx4q-wxvrPatch, Third Party Advisory
https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=ff75f2899c60a4546ee2d532e68a3febd07bdd14Patch, Vendor Advisory
https://tuleap.net/plugins/tracker/?aid=16214Vendor Advisory

Timeline

Published: Oct 18, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-411565.4anuko/timetracker is an, open source time tracking system. In affected versions Time Tracker uses browser_today hidden control on a few page CVE-2021-411575.3FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implement CVE-2021-411587.5FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implement CVE-2021-411598.8FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. All FreeRDP clients prior to versi CVE-2021-41165.4yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-411608.8FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions a malicious s CVE-2021-411616.1Combodo iTop is a web based IT Service Management tool. In versions prior to 3.0.0-beta6 the export CSV page don't properly escape the user CVE-2021-411626.1Combodo iTop is a web based IT Service Management tool. In 3.0.0 beta releases prior to beta6 the `ajax.render.php?operation=wizard_helper` CVE-2021-411639.8Discourse is an open source platform for community discussion. In affected versions maliciously crafted requests could lead to remote code e CVE-2021-411645.4CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (AC CVE-2021-411655.4CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module CVE-2021-411665.3The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. An issue in versions prior to 3.17.1 may