Vulnerability · Published Mar 31, 2025 · Assigned by GitHub_M
CVE-2025-30209Tuleap has improper permission handling in the REST endpoints and release notes display of the FRS plugin
Medium 5.3
In plain English
A medium-severity incorrect authorization in tuleap from Enalean. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.4%top 68.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker can access release notes content or information via the FRS REST endpoints it should not have access to. This vulnerability is fixed in Tuleap Community Edition 16.5.99.1742812323 and Tuleap Enterprise Edition 16.5-6 and 16.4-10.
Affected products (as reported)
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://github.com/Enalean/tuleap/security/advisories/GHSA-hcp5-pmpm-mgwh x_refsource_CONFIRM
- https://github.com/Enalean/tuleap/commit/34af2d5d10b0349967129f53427f495815e5bbcc x_refsource_MISC
- https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=34af2d5d10b0349967129f53427f495815e5bbcc x_refsource_MISC
- https://tuleap.net/plugins/tracker/?aid=42251 x_refsource_MISC