Skip to content
Fencer Vulns
medium 6.7

CVE-2021-41276 json

Indirect LDAP injection in Tuleap

published 2021-12-15 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-28309

cvss
6.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.5%
EPSS 1.5% chance of exploitation in 30 days, percentile 74%
public exploits
0
none known

Summary

Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. In affected versions Tuleap does not sanitize properly the search filter built from the ldap_id attribute of a user during the daily synchronization. A malicious user could force accounts to be suspended or take over another account by forcing the update of the ldap_uid attribute. Note that the malicious user either need to have site administrator capability on the Tuleap instance or be an LDAP operator with the capability to create/modify account. The Tuleap instance needs to have the LDAP plugin activated and enabled for this issue to be exploitable. This issue has been patched in Tuleap Community Edition 13.2.99.31, Tuleap Enterprise Edition 13.1-5, and Tuleap Enterprise Edition 13.2-3.

Patch / fix

  • enalean tuleap 13.1-5, 13.2-3, 13.2.99.31

Exploit prediction

1.53% chance of exploitation in the next 30 days, higher than 74% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
NVD 3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.0 AV:N/AC:M/Au:S/C:P/I:P/A:P

Affected products

  • Enalean tuleap

Classification

Weakness
  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component
  • CWE-90 Improper Neutralization of Special Elements used in an LDAP Query

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.