Taiga API Time-Based Blind SQL Injection Vulnerability Allowing Sensitive Data Disclosure

A time-based blind SQL injection vulnerability has been identified in the Taiga API, specifically in versions through 6.8.3. This vulnerability allows for the unauthorized disclosure of sensitive data by manipulating response timing. The issue has been addressed in version 6.9.0.

Impact

Exploitation of this vulnerability could lead to unauthorized access and disclosure of sensitive data from the database, based on the attacker's ability to manipulate and observe response times.

Remediation

Users can upgrade to Taiga version 6.9.0 to address this vulnerability.