CVE-2017-7411 - CVE House
Back to Database
Status published High CVE-2017-7411

An issue was discovered in Enalean Tuleap 9.6 and prior...

Vulnerability Description

An issue was discovered in Enalean Tuleap 9.6 and prior versions. The vulnerability exists because the User::getRecentElements() method is using the unserialize() function with a preference value that can be arbitrarily manipulated by malicious users through the REST API interface, and this can be exploited to inject arbitrary PHP objects into the application scope, allowing an attacker to perform a variety of attacks (including but not limited to Remote Code Execution).

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-7411

Credits & Attribution

No credits recorded in the NVD database.

References

More from enalean

View All →
CVE-2018-7634
An issue was discovered in Enalean Tuleap 9.17. Lack of...
High 8.8
CVE-2018-7538
A SQL injection vulnerability in the tracker functionality of Enalean...
Critical 9.8
CVE-2018-17298
An issue was discovered in Enalean Tuleap before 10.5. Reset...
Critical 9.8
CVE-2017-7981
Tuleap before 9.7 allows command injection via the PhpWiki 1.3.10...
High 8.8
CVE-2014-8791
project/register.php in Tuleap before 7.7, when sys_create_project_in_one_step is disabled, allows...
Medium 6

Affected Vendor

Affected Software

tuleap
Vulnerable Versions:
0

Timeline

Official Publish: October 30th, 2017
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.