Vulnerability · Published Mar 4, 2025 · Assigned by GitHub_M

CVE-2025-27402Tuleap is missing CSRF protections on tracker fields administrative operations

Medium 4.6

In plain English

A medium-severity cross-site request forgery in tuleap from Enalean. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 3.1)4.6Medium

Exploit odds (30 days)0.2%top 94.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap is missing CSRF protections on tracker fields administrative operations. An attacker could use this vulnerability to trick victims into removing or updating tracker fields. This vulnerability is fixed in Tuleap Community Edition 16.4.99.1740414959 and Tuleap Enterprise Edition 16.4-6 and 16.3-11.

Affected products (as reported)

Vendor	Product	Versions
Enalean	tuleap	< 16.4.99.1740414959

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

References

https://github.com/Enalean/tuleap/security/advisories/GHSA-66pg-cpjf-2mfg x_refsource_CONFIRM
https://github.com/Enalean/tuleap/commit/ea6319e2ad40beeda335af4ccd7a204a6912765c x_refsource_MISC
https://tuleap.net/plugins/tracker/?aid=41857 x_refsource_MISC