Home

Description

Tuleap is an Open Source Suite for management of software development and collaboration. Tuleap Community Edition versions below 17.0.99.1762444754 and Tuleap Enterprise Edition versions prior to 17.0-2, 16.13-7 and 16.12-10 allow attackers trick victims into changing tracker general settings. This issue is fixed in version Tuleap Community Edition version 17.0.99.1762444754 and Tuleap Enterprise Edition versions 17.0-2, 16.13-7 and 16.12-10.

PUBLISHED Reserved 2025-11-05 | Published 2025-12-08 | Updated 2025-12-09 | Assigner GitHub_M




MEDIUM: 4.6CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Problem types

CWE-352: Cross-Site Request Forgery (CSRF)

Product status

Tuleap Community Edition < 17.0.99.1762444754
affected

Tuleap Enterprise Edition < 17.0-2
affected

Tuleap Enterprise Edition < 16.13-7
affected

Tuleap Enterprise Edition < 16.12-10
affected

References

github.com/...tuleap/security/advisories/GHSA-vxfh-h8p6-p5rg

github.com/...ommit/993316dd6a291bb3937cb7a4571eaab0e7d55370

tuleap.net/...mit&h=993316dd6a291bb3937cb7a4571eaab0e7d55370

tuleap.net/plugins/tracker/?aid=45593

cve.org (CVE-2025-64498)

nvd.nist.gov (CVE-2025-64498)

Download JSON