Vulnerability CVE-2014-7178
Published: 2014-11-28

Description:
Enalean Tuleap before 7.5.99.6 allows remote attackers to execute arbitrary commands via the User-Agent header, which is provided to the passthru PHP function.

See advisories in our WLB2 database:
Topic
Author
Date
High
Tuleap 7.4.99.5 Remote Command Execution
Jerzy Kramarz
29.10.2014

Type:

CWE-20

 (Improper Input Validation)

CVSS2 => (AV:N/AC:M/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
9.3/10
10/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Enalean -> Tuleap 

 References:
https://www.tuleap.org/recent-vulnerabilities
https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-7178/
http://seclists.org/fulldisclosure/2014/Oct/121
Copyright 2024, cxsecurity.com

 

Back to Top