CVE-2014-7178

High

Published: 28/11/2014(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

Enalean Tuleap before 7.5.99.6 allows remote attackers to execute arbitrary commands via the User-Agent header, which is provided to the passthru PHP function.

Risk Assessment

Attackers can exploit this vulnerability to execute remote code, potentially leading to system compromise or data leakage.

Recommendation

It is recommended to upgrade Enalean Tuleap to version 7.5.99.6 or later to mitigate this vulnerability.

Other vulnerabilities in Enalean Tuleap

CVE-2017-7411High
An issue was discovered in Enalean Tuleap 9.6 and prior versions related to the User::getRecentElements() method using the unserialize() function with a manipulable preference value. This can lead to injecting arbitrary PHP objects into the application scope.

Original NVD description (English source)

Enalean Tuleap before 7.5.99.6 allows remote attackers to execute arbitrary commands via the User-Agent header, which is provided to the passthru PHP function.