A stored cross‑site scripting vulnerability allows an attacker to implant and execute arbitrary JavaScript within the browser sessions of users who view affected content. When the script runs, the attacker can hijack user sessions, harvest credentials, deface the application, or exfiltrate sensitive data. The CVSS score of 8.7 indicates a high severity because the flaw can be leveraged to compromise confidentiality and integrity of client data and possibly the broader network if an attacker gains a foothold from the client side.

Dassault Systèmes’ Tuleap Enterprise Edition versions 17.0 through 17.5 are affected. No other versions or products are listed as vulnerable. Administrators should verify that any installations within this version range are patched or upgraded.

The vulnerability is a stored XSS flaw (CWE‑79), meaning an attacker can persist malicious code in a data store that is later rendered in a user’s browser. Because the attack requires only that a user view the compromised content, an attacker can target any authenticated or even unauthenticated user who visits the affected page. The EPSS score is not available, but the high CVSS rating and lack of a KEV listing suggest that exploitation is unlikely to be widespread yet, yet the potential impact is significant. Likely attack vector involves exploiting content fields that are not properly sanitized, such as project descriptions or comment sections.