CVE-2021-43806

Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. In affected versions Tuleap does not sanitize properly user settings when constructing the SQL query to browse and search commits in the CVS repositories. A authenticated malicious user with read access to a CVS repository could execute arbitrary SQL queries. Tuleap instances without an active CVS repositories are not impacted. The following versions contain the fix: Tuleap Community Edition 13.2.99.155, Tuleap Enterprise Edition 13.1-7, and Tuleap Enterprise Edition 13.2-6.

• CWE-89

• https://github.com/Enalean/tuleap/commit/b82be896b00a787ed46a77bd4700e8fccfe2e5baPatch, Third Party Advisory
• https://github.com/Enalean/tuleap/security/advisories/GHSA-x8fr-8gvw-cc4vPatch, Third Party Advisory
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=b82be896b00a787ed46a77bd4700e8fccfe2e5baPatch, Vendor Advisory
• https://tuleap.net/plugins/tracker/?aid=24202Issue Tracking, Patch, Vendor Advisory
• https://github.com/Enalean/tuleap/commit/b82be896b00a787ed46a77bd4700e8fccfe2e5baPatch, Third Party Advisory
• https://github.com/Enalean/tuleap/security/advisories/GHSA-x8fr-8gvw-cc4vPatch, Third Party Advisory
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=b82be896b00a787ed46a77bd4700e8fccfe2e5baPatch, Vendor Advisory
• https://tuleap.net/plugins/tracker/?aid=24202Issue Tracking, Patch, Vendor Advisory

Published

Dec 15, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43800Wiki.js is a wiki app built on Node.js. Prior to version 2.5…7.5
• CVE-2021-43801Mercurius is a GraphQL adapter for Fastify. Any users from M…7.5
• CVE-2021-43802Etherpad is a real-time collaborative editor. In versions pr…8.8
• CVE-2021-43803Next.js is a React framework. In versions of Next.js prior t…7.5
• CVE-2021-43804PJSIP is a free and open source multimedia communication lib…7.3
• CVE-2021-43805Solidus is a free, open-source ecommerce platform built on R…7.5
• CVE-2021-43807Opencast is an Open Source Lecture Capture & Video Managemen…6.5
• CVE-2021-43808Laravel is a web application framework. Laravel prior to ver…6.1
• CVE-2021-43809`Bundler` is a package for managing application dependencies…7.3
• CVE-2021-4381The uListing plugin for WordPress is vulnerable to authoriza…9.8
• CVE-2021-43810Admidio is a free open source user management system for web…6.1
• CVE-2021-43811Sockeye is an open-source sequence-to-sequence framework for…7.8