CVE-2021-41142: Enalean Tuleap

Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days.

Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. There is a cross-site scripting vulnerability in Tuleap Community Edition prior to 12.11.99.25 and Tuleap Enterprise Edition 12.11-2. A malicious user with the capability to add and remove attachment to an artifact could force a victim to execute uncontrolled code. Tuleap Community Edition 11.17.99.146 and Tuleap Enterprise Edition 12.11-2 contain a fix for the issue.

Affected products

• Enalean Tuleap: before 11.17.99.146 (fixed in 11.17.99.146); before 12.11-2 (fixed in 12.11-2)

Published 2021-10-14. Last modified 2026-06-17.