Log in Start free

Vulnerability · Published Dec 8, 2025 · Assigned by GitHub_M

CVE-2025-65962Tuleap has missing CSRF protections its in tracker field dependencies

Medium 4.6

In plain English

A medium-severity cross-site request forgery in tuleap from Enalean. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 3.1)4.6Medium
Exploit odds (30 days)0.2%top 94.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Tuleap is a free and open source suite for management of software development and collaboration. Versions of Tuleap Community Edition prior to 17.0.99.1763803709 and Tuleap Enterprise Edition versions prior to 17.0-4 and 16.13-9 are mission CSRF protections in its tracker field dependencies, allowing attackers to modify tracker fields. This issue is fixed in Tuleap Community Edition version 17.0.99.1763803709 and Tuleap Enterprise Edition versions 17.0-4 and 16.13-9.

Affected products (as reported)

VendorProductVersions
Enalean tuleap Tuleap Community Edition < 17.0.99.1763803709Tuleap Enterprise Edition < 17.0-4Tuleap Enterprise Edition < 16.13-9

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

References