This vulnerability (CWE-1393) affects Tuleap Enterprise Edition versions 17.0-1 and 17.5-1. It arises from the use of a default password on user accounts created during XML import processes. An attacker could exploit this to access these accounts without authorization. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality and integrity impact, and low availability impact. There is no vendor advisory or patch information available at this time.

Successful exploitation would allow an attacker to gain unauthorized access to user accounts created during XML import, potentially compromising confidentiality and integrity of data associated with those accounts. Availability impact is low. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider reviewing and changing default passwords for imported user accounts manually if possible and restrict access to XML import functionality to trusted users only.