CVE-2025-64499

Tuleap is a free and open source suite for management of software development and collaboration. Tuleap Community Editon versions prior to 17.0.99.1762456922 and Tuleap Enterprise Edition versions prior to 17.0-2, 16.13-7 and 16.12-10 are vulnerable to CSRF attacks through planning management API. Attackers have access to create, edit or remove plans. This issue is fixed in Tuleap Community Edition version 17.0.99.1762456922 and Tuleap Enterprise Edtion versions 17.0-2, 16.13-7 and 16.12-10.

CVSS v3 4.6 MEDIUM

4.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/Enalean/tuleap/commit/1734a7bb2964042310ddc3f6dd7b4c82eee27526	Patch
https://github.com/Enalean/tuleap/security/advisories/GHSA-9h47-jg7r-ww7x	Vendor Advisory
https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=1734a7bb2964042310ddc3f6dd7b4c82eee27526	Broken Link Patch
https://tuleap.net/plugins/tracker/?aid=45592	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:enalean:tuleap:::::enterprise:::*
	cpe:2.3:a:enalean:tuleap:::::community:::*
	cpe:2.3:a:enalean:tuleap:::::enterprise:::*
	cpe:2.3:a:enalean:tuleap:::::enterprise:::*

History

07 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Tuleap es una suite de código abierto y gratuita para la gestión del desarrollo de software y la colaboración. Las versiones de Tuleap Community Edition anteriores a 17.0.99.1762456922 y las versiones de Tuleap Enterprise Edition anteriores a 17.0-2, 16.13-7 y 16.12-10 son vulnerables a ataques CSRF a través de la API de gestión de planificación. Los atacantes tienen acceso para crear, editar o eliminar planes. Este problema está solucionado en la versión 17.0.99.1762456922 de Tuleap Community Edition y en las versiones 17.0-2, 16.13-7 y 16.12-10 de Tuleap Enterprise Edition.

Information

Published : 2025-12-08 23:15

Updated : 2026-10-07 20:10

NVD link : CVE-2025-64499

Mitre link : CVE-2025-64499

CVE.ORG link : CVE-2025-64499

JSON object : View

Products Affected

enalean

tuleap

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2025-64499", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64499", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-09T14:19:21.955484Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Enalean", "product": "tuleap", "versions": [{"status": "affected", "version": "Tuleap Community Edition < 17.0.99.1762456922"}, {"status": "affected", "version": "Tuleap Enterprise Edition < 17.0-2"}, {"status": "affected", "version": "Tuleap Enterprise Edition < 16.13-7"}, {"status": "affected", "version": "Tuleap Enterprise Edition < 16.12-10"}]}]}], "published": "2025-12-08T23:15:48.330", "references": [{"url": "https://github.com/Enalean/tuleap/commit/1734a7bb2964042310ddc3f6dd7b4c82eee27526", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/Enalean/tuleap/security/advisories/GHSA-9h47-jg7r-ww7x", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=1734a7bb2964042310ddc3f6dd7b4c82eee27526", "tags": ["Broken Link", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://tuleap.net/plugins/tracker/?aid=45592", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Tuleap is a free and open source suite for management of software development and collaboration. Tuleap Community Editon versions prior to 17.0.99.1762456922 and Tuleap Enterprise Edition versions prior to 17.0-2, 16.13-7 and 16.12-10 are vulnerable to CSRF attacks through planning management API. Attackers have access to create, edit or remove plans. This issue is fixed in Tuleap Community Edition version 17.0.99.1762456922 and Tuleap Enterprise Edtion versions 17.0-2, 16.13-7 and 16.12-10."}, {"lang": "es", "value": "Tuleap es una suite de c\u00f3digo abierto y gratuita para la gesti\u00f3n del desarrollo de software y la colaboraci\u00f3n. Las versiones de Tuleap Community Edition anteriores a 17.0.99.1762456922 y las versiones de Tuleap Enterprise Edition anteriores a 17.0-2, 16.13-7 y 16.12-10 son vulnerables a ataques CSRF a trav\u00e9s de la API de gesti\u00f3n de planificaci\u00f3n. Los atacantes tienen acceso para crear, editar o eliminar planes. Este problema est\u00e1 solucionado en la versi\u00f3n 17.0.99.1762456922 de Tuleap Community Edition y en las versiones 17.0-2, 16.13-7 y 16.12-10 de Tuleap Enterprise Edition."}], "lastModified": "2026-10-07T20:10:01.970", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "286870BF-3315-4B78-AC67-97EB2D5F34ED", "versionEndExcluding": "16.12-10"}, {"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "8A6B5D51-B4FC-425D-AC04-211E1B0E8A50", "versionEndExcluding": "17.0.99.1762456922"}, {"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "CBD9092A-8E4A-43EF-B9B8-D8BDA9D30430", "versionEndExcluding": "16.13-7", "versionStartIncluding": "16.13"}, {"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "F96A9306-179A-48BD-A2D9-CB081E9747B8", "versionEndExcluding": "17.0-2", "versionStartIncluding": "17.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}