CVE-2021-41276
CVE-2021-41276 is a medium-severity vulnerability in Enalean Tuleap with a CVSS 3.x base score of 6.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-74.
Key facts
- Severity: Medium (CVSS 3.x base score 6.7)
- CVSS v2: 6.0
- EPSS exploit prediction: 1% (71st percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-74
- Affected product: Enalean Tuleap
- Published:
- Last modified:
Description
Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. In affected versions Tuleap does not sanitize properly the search filter built from the ldap_id attribute of a user during the daily synchronization. A malicious user could force accounts to be suspended or take over another account by forcing the update of the ldap_uid attribute. Note that the malicious user either need to have site administrator capability on the Tuleap instance or be an LDAP operator with the capability to create/modify account. The Tuleap instance needs to have the LDAP plugin activated and enabled for this issue to be exploitable. This issue has been patched in Tuleap Community Edition 13.2.99.31, Tuleap Enterprise Edition 13.1-5, and Tuleap Enterprise Edition 13.2-3.
Frequently asked questions
- What is CVE-2021-41276?
- Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. In affected versions Tuleap does not sanitize properly the search filter built from the ldap_id attribute of a user during the daily synchronization. A malicious user could force accounts to be suspended or take over another account by forcing the update of the ldap_uid attribute. Note that the malicious user either need to have site administrator capability on the Tuleap instance or be an LDAP operator with the capability to create/modify account. The Tuleap instance needs to have the LDAP plugin activated and enabled for this issue to be exploitable. This issue has been patched in Tuleap Community Edition 13.2.99.31, Tuleap Enterprise Edition 13.1-5, and Tuleap Enterprise Edition 13.2-3.
- How severe is CVE-2021-41276?
- CVE-2021-41276 has a CVSS 3.x base score of 6.7, rated medium severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability low.
- Is CVE-2021-41276 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (71st percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2021-41276?
- CVE-2021-41276 primarily affects Enalean Tuleap. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2021-41276?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2021-41276 published?
- CVE-2021-41276 was published on 2021-12-15 and last updated on 2026-06-17.
References
- https://github.com/Enalean/tuleap/commit/bd47f29847fcd6a68d359bc8aefb8749bb8a1b7c
- https://github.com/Enalean/tuleap/security/advisories/GHSA-887w-pv2r-x8pm
- https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=bd47f29847fcd6a68d359bc8aefb8749bb8a1b7c
- https://tuleap.net/plugins/tracker/?aid=24149
Affected products (2)
- cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:*
- cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*
More vulnerabilities in Enalean Tuleap
- CVE-2018-17298 — Critical (CVSS 9.8): An issue was discovered in Enalean Tuleap before 10.5. Reset password links are not invalidated after a user changes…
- CVE-2018-7538 — Critical (CVSS 9.8): A SQL injection vulnerability in the tracker functionality of Enalean Tuleap software engineering platform before 9.18…
- CVE-2014-7178 — Critical (CVSS 9.3): Enalean Tuleap before 7.5.99.6 allows remote attackers to execute arbitrary commands via the User-Agent header, which…
- CVE-2021-43806 — High (CVSS 8.8): Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. In affected…
- CVE-2021-41155 — High (CVSS 8.8): Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected…
- CVE-2021-41154 — High (CVSS 8.8): Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected…
All CVEs affecting Enalean Tuleap →
Other CWE-74 (Improper Neutralization of Special Elements (Injection)) vulnerabilities
- CVE-2026-25586 — Critical (CVSS 10.0): SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, a sandbox escape is possible by shadowing hasOwnProperty…
- CVE-2026-25520 — Critical (CVSS 10.0): SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, The return values of functions aren't wrapped.…
- CVE-2025-20265 — Critical (CVSS 10.0): A vulnerability in the RADIUS subsystem implementation of Cisco Secure Firewall Management Center (FMC) Software could…
- CVE-2025-20337 — Critical (CVSS 10.0): A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to…
- CVE-2025-20281 — Critical (CVSS 10.0): A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to…
- CVE-2024-42472 — Critical (CVSS 10.0): Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious…
Browse all CWE-74 (Improper Neutralization of Special Elements (Injection)) vulnerabilities →