CVE-2017-7411

High

Published: 30/10/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

An issue was discovered in Enalean Tuleap 9.6 and prior versions related to the User::getRecentElements() method using the unserialize() function with a manipulable preference value. This can lead to injecting arbitrary PHP objects into the application scope.

Risk Assessment

This vulnerability allows attackers to perform various attacks, including Remote Code Execution, posing a serious security threat to the system.

Recommendation

It is recommended to update Enalean Tuleap to the latest version to mitigate this vulnerability and restrict access to the REST API only to trusted users.

Other vulnerabilities in Enalean Tuleap

CVE-2014-7178High
Enalean Tuleap before 7.5.99.6 allows remote attackers to execute arbitrary commands via the User-Agent header, which is provided to the passthru PHP function.

Original NVD description (English source)

An issue was discovered in Enalean Tuleap 9.6 and prior versions. The vulnerability exists because the User::getRecentElements() method is using the unserialize() function with a preference value that can be arbitrarily manipulated by malicious users through the REST API interface, and this can be exploited to inject arbitrary PHP objects into the application scope, allowing an attacker to perform a variety of attacks (including but not limited to Remote Code Execution).