Read the docs
TI-2021-17981 Aliases CVE-2021-41142

XSS via the name of a deleted attachment

Priority LOW 26CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. There is a cross-site scripting vulnerability in Tuleap Community Edition prior to 12.11.99.25 and Tuleap Enterprise Edition 12.11-2. A malicious user with the capability to add and remove attachment to an artifact could force a victim to execute uncontrolled code. Tuleap Community Edition 11.17.99.146 and Tuleap Enterprise Edition 12.11-2 contain a fix for the issue.

Why it matters now

EPSS 0.00725 54th percentileScored 2026-11-07
Fix Fixed tuleap (Enalean): 12.11.99.25, 12.11-2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Enaleantuleapbefore 12.11.99.25; 12.11-1 to before 12.11-212.11.99.25, 12.11-2Patch availableCNA
  • tuleap VendorEnalean Affected before 12.11.99.25; 12.11-1 to before 12.11-2 Fixed in 12.11.99.25, 12.11-2 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:*before 11.17.99.146VulnerableEnalean
cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*before 12.11-2VulnerableEnalean
  • cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:* Versions before 11.17.99.146 Vulnerable ·Enalean
  • cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:* Versions before 12.11-2 Vulnerable ·Enalean

Remediation

  • Fix · CNA tuleap (Enalean) Fixed in 12.11.99.25, 12.11-2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-41142

References

Patch 3

Advisory 1

  • TI-2017-05064 An issue was discovered in Enalean Tuleap 9.6 and prior versions. CVSS 3.0HIGH 8.8
  • TI-2023-19888 Tuleap allows preview of a linked artifact with a type does not respect permissions CVSS 3.1MEDIUM 6.5
  • TI-2025-21539 Tuleap allows XSS via the content of RSS feeds in the RSS widgets CVSS 3.1MEDIUM 4.8
  • TI-2024-16583 Tuleap's mass update clears the permissions on artifact field CVSS 3.1MEDIUM 6.5
  • TI-2024-15444 Tuleap's content of artifacts might be readable by unauthorized users CVSS 3.1MEDIUM 6.5
  • TI-2024-31377 Tuleap does not properly check permissions for email notifications in trackers CVSS 3.1MEDIUM 5.7
See all 67 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences