This vulnerability is a stored cross‑site scripting flaw that allows arbitrary HTML or JavaScript to be written into Tuleap’s database. When a victim views the affected content, the malicious script executes in the victim’s browser, enabling the attacker to steal authentication tokens, deface pages or redirect the user to malicious sites. The weakness is classified as CWE‑79.

The flaw affects Dassault Systèmes Tuleap Enterprise Edition versions 17.0 through 17.5. Any deployment of these versions is vulnerable if it permits the storage of unsanitized user‑supplied data.

The CVSS score of 8.7 reflects a high risk to confidentiality, integrity, and availability of the user session. EPSS data is not available, so the current exploitation probability cannot be quantified, but the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a web‑based interface that accepts user input; the attacker need only insert malicious content via the application, after which any user who accesses the stored data will be impacted.