CVE-2017-7411
HighPublic exploitThe vulnerability exists because the User::getRecentElements() method is using the unserialize() function with a preference value that can be arbitrarily manipulated by malicious users through the REST API interface, and this can be exploited to inject arbitrary PHP objects into…
Published Oct 30, 2017 · Updated May 12, 2026
Key Facts
Patch immediately- CVE-2017-7411 is a high-severity vulnerability (CVSS 8.8 v3.1) affecting Tuleap (Enalean).
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 67% probability of exploitation in the next 30 days.
- Fixed versions are available, including Tuleap 9.6.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
8.8
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
67%
Higher than 99.2% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2017-7411 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
An issue was discovered in Enalean Tuleap 9.6 and prior versions. The vulnerability exists because the User::getRecentElements() method is using the unserialize() function with a preference value that can be arbitrarily manipulated by malicious users through the REST API interface, and this can be exploited to inject arbitrary PHP objects into the application scope, allowing an attacker to perform a variety of attacks (including but not limited to Remote Code Execution).
Affected Products
1 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| TuleapEnalean | See advisory | 9.6 |
Patched Releases
Tuleap
9.6
Timeline
Publicly disclosed
Oct 30, 2017
Last updated
May 12, 2026
Weakness Type
- CWE-94 Improper Control of Generation of Code ('Code Injection')
References
- advisoryhttp://karmainsecurity.com/KIS-2017-02
- advisoryhttp://packetstormsecurity.com/files/144716/Tuleap-9.6-Second-Order-PHP-Object-Injection.html
- advisory20171023 [KIS-2017-02] Tuleap <= 9.6 Second-Order PHP Object Injection Vulnerability
- advisory[oss-security] 20171023 [KIS-2017-02] Tuleap <= 9.6 Second-Order PHP Object Injection Vulnerability
- exploitMSF tuleap_rest_unserialize_exec.rb
FAQ
Common Questions.
An issue was discovered in Enalean Tuleap 9.6 and prior versions.
Affected: Tuleap (Enalean). The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including Tuleap 9.6.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2017-7411 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo