EDB-35099

functional

Enalean Tuleap 7.2 - XML External Entity File Disclosure

view exploit source exploit_dbverifiedtype webappsauthor Portcullispublished 2014-10-28catalog exploit_db

exploited CVEs (2)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2014-7176US	medium6.5	2.20% (82nd)	Exploit	2014-11-04
SQL injection vulnerability in Enalean Tuleap before 7.5.99.4 allows remote authenticated users to execute arbitrary SQL commands via the lobal_txt parameter to plugins/docman.
CVE-2014-7177US	medium4.0	3.32% (89th)	Exploit	2014-10-31
XML External Entity vulnerability in Enalean Tuleap 7.2 and earlier allows remote authenticated users to read arbitrary files via a crafted xml document in a create action to plugi…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.