High severity8.8NVD Advisory· Published Dec 15, 2021· Updated Jun 17, 2026
CVE-2021-43806
CVE-2021-43806
Description
Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. In affected versions Tuleap does not sanitize properly user settings when constructing the SQL query to browse and search commits in the CVS repositories. A authenticated malicious user with read access to a CVS repository could execute arbitrary SQL queries. Tuleap instances without an active CVS repositories are not impacted. The following versions contain the fix: Tuleap Community Edition 13.2.99.155, Tuleap Enterprise Edition 13.1-7, and Tuleap Enterprise Edition 13.2-6.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
5cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:*+ 3 more
- cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:*range: <13.2.99.155
- cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*range: >=13.1-1,<13.1-7
- (no CPE)range: before 13.2.99.155, 13.1 before 13.1-7, 13.2 before 13.2-6
- (no CPE)range: < 13.2.99.155
Patches
Vulnerability mechanics
References
4- github.com/Enalean/tuleap/commit/b82be896b00a787ed46a77bd4700e8fccfe2e5banvdPatchThird Party Advisory
- github.com/Enalean/tuleap/security/advisories/GHSA-x8fr-8gvw-cc4vnvdPatchThird Party Advisory
- tuleap.net/plugins/git/tuleap/tuleap/stablenvdPatchVendor Advisory
- tuleap.net/plugins/tracker/nvdIssue TrackingPatchVendor Advisory
News mentions
0No linked articles in our index yet.