CVE-2017-7981 - CVE House
Back to Database
Status published High CVE-2017-7981

Tuleap before 9.7 allows command injection via the PhpWiki 1.3.10...

Vulnerability Description

Tuleap before 9.7 allows command injection via the PhpWiki 1.3.10 SyntaxHighlighter plugin. This occurs in the Project Wiki component because the proc_open PHP function is used within PhpWiki before 1.5.5 with a syntax value in its first argument, and an authenticated Tuleap user can control this value, even with shell metacharacters, as demonstrated by a '<?plugin SyntaxHighlighter syntax="c;id"' line to execute the id command.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-7981

Credits & Attribution

No credits recorded in the NVD database.

References

More from enalean

View All →
CVE-2018-7634
An issue was discovered in Enalean Tuleap 9.17. Lack of...
High 8.8
CVE-2018-7538
A SQL injection vulnerability in the tracker functionality of Enalean...
Critical 9.8
CVE-2018-17298
An issue was discovered in Enalean Tuleap before 10.5. Reset...
Critical 9.8
CVE-2017-7411
An issue was discovered in Enalean Tuleap 9.6 and prior...
High 8.8
CVE-2014-8791
project/register.php in Tuleap before 7.7, when sys_create_project_in_one_step is disabled, allows...
Medium 6

Affected Vendor

Affected Software

tuleap, phpwiki
Vulnerable Versions:
0, 1.3.10

Timeline

Official Publish: April 29th, 2017
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.