Log in Start free

Vulnerability · Published Dec 8, 2025 · Assigned by GitHub_M

CVE-2025-64499Tuleap is missing CSRF protections for its planning management API

Medium 4.6

In plain English

A medium-severity cross-site request forgery in tuleap from Enalean. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 3.1)4.6Medium
Exploit odds (30 days)0.1%top 96.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Tuleap is a free and open source suite for management of software development and collaboration. Tuleap Community Editon versions prior to 17.0.99.1762456922 and Tuleap Enterprise Edition versions prior to 17.0-2, 16.13-7 and 16.12-10 are vulnerable to CSRF attacks through planning management API. Attackers have access to create, edit or remove plans. This issue is fixed in Tuleap Community Edition version 17.0.99.1762456922 and Tuleap Enterprise Edtion versions 17.0-2, 16.13-7 and 16.12-10.

Affected products (as reported)

VendorProductVersions
Enalean tuleap Tuleap Community Edition < 17.0.99.1762456922Tuleap Enterprise Edition < 17.0-2Tuleap Enterprise Edition < 16.13-7Tuleap Enterprise Edition < 16.12-10

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

References