This issue has been patched in Tuleap Community Edition 13.2.99.31, Tuleap Enterprise Edition 13.1-5, and Tuleap Enterprise Edition 13.2-3. The Tuleap instance needs to have the LDAP plugin activated and enabled for this issue to be exploitable. Note that the malicious user either need to have site administrator capability on the Tuleap instance or be an LDAP operator with the capability to create/modify account.
A malicious user could force accounts to be suspended or take over another account by forcing the update of the ldap_uid attribute. In affected versions Tuleap does not sanitize properly the search filter built from the ldap_id attribute of a user during the daily synchronization. Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. The following versions contain the fix: Tuleap Community Edition 13.2.99.83, Tuleap Enterprise Edition 13.1-6, and Tuleap Enterprise Edition 13.2-4. Tuleap does not sanitize properly the search filter built from the ldap_id attribute of a user during the daily synchronization. This is a follow up to GHSA-887w-pv2r-x8pm/CVE-2021-41276, the initial fix was incomplete.
The following versions contain the fix: Tuleap Community Edition 13.2.99.155, Tuleap Enterprise Edition 13.1-7, and Tuleap Enterprise Edition 13.2-6. Tuleap instances without an active CVS repositories are not impacted. A authenticated malicious user with read access to a CVS repository could execute arbitrary SQL queries. In affected versions Tuleap does not sanitize properly user settings when constructing the SQL query to browse and search commits in the CVS repositories.