CVE-2022-31063mediumCWE-79

CVE-2022-31063: falha de média gravidade em Enalean tuleap

Cross site scripting via the title of a document in Tuleap

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar tuleap

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 0.7%
Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior to 13.9.99.111 the title of a document is not properly escaped in the search result of MyDocmanSearch widget and in the administration page of the locked documents. A malicious user with the capability to create a document could force victim to execute uncontrolled code. Users are advised to upgrade. There are no known workarounds for this issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Produtos afetados
Enalean · tuleap
CVEs relacionadas — Enalean tuleap

No mesmo produto, das mais perigosas para as menos.

CVE-2021-41147HIGHSQL injection in the planning edition panelEPSS 1.9%CVE-2021-43806HIGHSQL injection in TuleapEPSS 1.6%CVE-2021-41276MEDIUMIndirect LDAP injection in TuleapEPSS 1.5%CVE-2021-41154HIGHSQL injection in the "SVN core" commits browserEPSS 1.5%CVE-2021-41155HIGHSQL injection in CVS revisions browserEPSS 1.5%CVE-2021-41148HIGHThe update of the CI job targeted by a widget is vulnerable to blind SQL injectionsEPSS 1.5%