CVE-2021-41276

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. In affected versions Tuleap does not sanitize properly the search filter built from the ldap_id attribute of a user during the daily synchronization. A malicious user could force accounts to be suspended or take over another account by forcing the update of the ldap_uid attribute. Note that the malicious user either need to have site administrator capability on the Tuleap instance or be an LDAP operator with the capability to create/modify account. The Tuleap instance needs to have the LDAP plugin activated and enabled for this issue to be exploitable. This issue has been patched in Tuleap Community Edition 13.2.99.31, Tuleap Enterprise Edition 13.1-5, and Tuleap Enterprise Edition 13.2-3.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-90

Affected software

No affected versions have been published.

Timeline

Published: Dec 15, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-412777.5Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`CVE-2021-412785.7Functions SDK for EdgeX is meant to provide all the plumbing necessary for developers to get started in processing/transforming/exporting da CVE-2021-412798.8BaserCMS is an open source content management system with a focus on Japanese language support. In affected versions users with upload privi CVE-2021-41286.5When transitioning in and out of fullscreen mode, a graphics object was not correctly protected; resulting in memory corruption and a potent CVE-2021-412809.8Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installatio CVE-2021-412817.5Synapse is a package for Matrix homeservers written in Python 3/Twisted. Prior to version 1.47.1, Synapse instances with the media repositor CVE-2021-412828.8diag_routes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data about the routes set in CVE-2021-412857.8Ballistix MOD Utility through 2.0.2.5 is vulnerable to privilege escalation in the MODAPI.sys driver component. The vulnerability is trigger CVE-2021-412867.8Omikron MultiCash Desktop 4.00.008.SP5 relies on a client-side authentication mechanism. When a user logs into the application, the validity CVE-2021-412889.8Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API.CVE-2021-412896.3ASUS P453UJ contains the Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability. With a general user’s permis CVE-2021-41299.8Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith, Christian Holler, and Masayuki Nakano r