CVE-2026-105408

{
  "etk_id": "ETK-2026-1349",
  "cve_id": "CVE-2026-105408",
  "display_id": "CVE-2026-105408",
  "ghsa_id": "GHSA-62g7-8rqf-3p27",
  "euvd_id": "EUVD-2026-97327",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Stored cross-site scripting in Tuleap Enterprise Edition",
  "summary": "Tuleap Enterprise Edition versions 17.0 through 17.5 are affected by a stored cross-site scripting flaw. An attacker may cause script to run in another user's browser session. The advisory does not state the attacker access or user-interaction precondition.",
  "mitigation": "Restrict access to trusted users and limit exposure to untrusted submitted content until vendor remediation is available. Monitor vendor updates and upgrade to the corrected release when it is published.",
  "vendor": "Dassault Systèmes",
  "product": "Tuleap Enterprise Edition",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 17.0-1, <= 17.0-41",
        ">= 17.5-1, <= 17.5-32"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Tuleap Enterprise Edition",
      "purl": null
    }
  ],
  "cwes": [
    79
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
  "epss_score": 0.002,
  "epss_percentile": 0.097,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 20.371994166666667,
  "t0_at": "2026-10-12T10:44:55.675000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-12T10:44:55.675000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-12T10:44:55.675000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105408"
    }
  }
}