CVE-2021-43782 Indirect LDAP injection in Tuleap
A malicious admin or LDAP operator can inject LDAP filters to suspend accounts or take over other user accounts in Tuleap.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-43782?
CVE-2021-43782 is a medium-severity vulnerability in Enalean Tuleap, published on 15 Dec 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. This is a follow up to GHSA-887w-pv2r-x8pm/CVE-2021-41276, the initial fix was incomplete. Tuleap does not sanitize properly the search filter built from the ldap_id attribute of a user during the daily synchronization. A malicious user could force accounts to be suspended or take over another account by forcing the update of the ldap_uid attribute. Note that the malicious user either need to have site administrator capability on the Tuleap instance or be an LDAP operator with the capability to create/modify account. The Tuleap instance needs to have the LDAP plugin activated and enabled for this issue to be exploitable. The following versions contain the fix: Tuleap Community Edition 13.2.99.83, Tuleap Enterprise Edition 13.1-6, and Tuleap Enterprise Edition 13.2-4.
Which versions are affected by CVE-2021-43782?
It affects 1 product.
Products include Enalean Tuleap.
How do I fix CVE-2021-43782?
No fix has been published for CVE-2021-43782 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-43782 being exploited?
There is no known exploitation of CVE-2021-43782 in the wild and no public exploit code.