CVE-2021-43806 is a critical SQL injection vulnerability affecting Tuleap, an open-source tool for application development traceability. Specifically, it impacts Tuleap instances with active CVS repositories, allowing an authenticated, malicious user with read access to execute arbitrary SQL queries due to improper sanitization of user settings. The vulnerability carries a CVSS score of 8.8 (High), indicating a severe risk. It can be exploited remotely with low attack complexity and requires only low privileges, potentially leading to high impact on confidentiality, integrity, and availability of the affected system. Currently, there is no evidence of active exploitation, nor is exploit code publicly available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, suggesting it has not garnered widespread attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 13.2.99.155CPE matchmatch criteria | cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:* | ||
>= 13.1-1, < 13.1-7CPE matchmatch criteria | cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:* | ||
>= 13.2-1, < 13.2-6CPE matchmatch criteria | cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.