Tuleap does not sanitize properly user inputs when constructing the SQL query to update the continuous integration job targeted by one of the widgets.
An attacker with the ability to add one the CI widget to its personal dashboard could execute arbitrary SQL queries.
CVSSv3.1 score: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Issue can be demonstrated by adding one the CI widget to a personal dashboard, edit it, set the value to submit to something like (SELECT BENCHMARK(50000000,ENCODE('MSG','Slow'))) and submit. You will notice a unexpected slowness.