The vulnerability is an SQL Injection flaw within Tuleap Enterprise Edition 17.5, as described by the CVE. It enables an attacker to read the contents of the Tuleap database, potentially exposing sensitive project and user information. The weakness is of type CWE‑89, reflecting insufficient input validation and sanitization of SQL queries.

The affected vendor is Dassault Systèmes, product Tuleap Enterprise Edition. The vulnerability applies to version 17.5 of this product. No additional versions are listed as affected.

With a CVSS score of 7.1, the flaw is considered a high‑severity vulnerability. The EPSS score is not available, so the exact probability of exploitation cannot be quantified, but the lack of a KEV listing suggests no widespread exploits are known. The likely attack vector is via web input fields that are reflected in database queries; an attacker needs access to the application or ability to send crafted requests, which can be performed from the network or potentially through social engineering. Once exploited, an attacker can exfiltrate data from the database, compromising confidentiality.