CVE-2025-29766
Tuleap has missing CSRF protections on artifact submission & edition from the tracker view
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Tuleap has missing CSRF protections on artifact submission & edition from the tracker view
Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap has missing CSRF protections on artifact submission & edition from the tracker view. An attacker could use this vulnerability to trick victims into submitting or editing artifacts or follow-up comments. The vulnerability is fixed in Tuleap Community Edition 16.5.99.1741784483 and Tuleap Enterprise Edition 16.5-3 and 16.4-8.
Reserved 2025-03-11 | Published 2025-03-31 | Updated 2025-03-31 | Assigner GitHub_MCWE-352: Cross-Site Request Forgery (CSRF)
github.com/...tuleap/security/advisories/GHSA-6p9q-p2q4-3rqx
github.com/...ommit/81f45330fdcc1329cc71eddf4d04b80c340b3b93
tuleap.net/...mit&h=81f45330fdcc1329cc71eddf4d04b80c340b3b93
tuleap.net/plugins/tracker/?aid=42208
Support options
