Enalean Tuleap 'unserialize()' Function Remote PHP Code Injection Vulnerability

Bugtraq ID:	71335
Class:	Input Validation Error
CVE:	CVE-2014-8791
Remote:	Yes
Local:	No
Published:	Nov 27 2014 12:00AM
Updated:	Nov 27 2014 12:00AM
Credit:	Egidio Romano
Vulnerable:
Not Vulnerable:

Enalean Tuleap 'unserialize()' Function Remote PHP Code Injection Vulnerability

Enalean Tuleap is prone to a remote PHP code-injection vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit this issue to inject and execute arbitrary PHP code in the context of the affected application. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

Enalean Tuleap 7.6-4 and prior are vulnerable.

Enalean Tuleap 'unserialize()' Function Remote PHP Code Injection Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Enalean Tuleap 'unserialize()' Function Remote PHP Code Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Enalean Tuleap 'unserialize()' Function Remote PHP Code Injection Vulnerability

References: