CVE-2025-27150

Tuleap is an Open Source Suite to improve management of software developments and collaboration. The password to connect the Redis instance is not purged from the archive generated with tuleap collect-system-data. These archives are likely to be used by support teams that should not have access to this password. The vulnerability is fixed in Tuleap Community Edition 16.4.99.1740492866 and Tuleap Enterprise Edition 16.4-6 and 16.3-11.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/Enalean/tuleap/commit/a6702622a8db969a17522b8fac0774afdb1c916f	Patch
https://github.com/Enalean/tuleap/security/advisories/GHSA-jc5r-684x-j46q	Third Party Advisory Patch
https://tuleap.net/plugins/tracker/?aid=41870	Vendor Advisory Issue Tracking Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:enalean:tuleap:::::enterprise:::*
	cpe:2.3:a:enalean:tuleap:::::community:::*
	cpe:2.3:a:enalean:tuleap:::::enterprise:::*

History

No history.

Information

Published : 2025-03-04 17:15

Updated : 2025-08-22 15:53

NVD link : CVE-2025-27150

Mitre link : CVE-2025-27150

CVE.ORG link : CVE-2025-27150

JSON object : View

Products Affected

enalean

tuleap

CWE

CWE-538

Insertion of Sensitive Information into Externally-Accessible File or Directory

{"id": "CVE-2025-27150", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2025-03-04T17:15:18.663", "references": [{"url": "https://github.com/Enalean/tuleap/commit/a6702622a8db969a17522b8fac0774afdb1c916f", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/Enalean/tuleap/security/advisories/GHSA-jc5r-684x-j46q", "tags": ["Third Party Advisory", "Patch"], "source": "[email protected]"}, {"url": "https://tuleap.net/plugins/tracker/?aid=41870", "tags": ["Vendor Advisory", "Issue Tracking", "Patch"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-538"}]}], "descriptions": [{"lang": "en", "value": "Tuleap is an Open Source Suite to improve management of software developments and collaboration. The password to connect the Redis instance is not purged from the archive generated with tuleap collect-system-data. These archives are likely to be used by support teams that should not have access to this password. The vulnerability is fixed in Tuleap Community Edition 16.4.99.1740492866 and Tuleap Enterprise Edition 16.4-6 and 16.3-11."}, {"lang": "es", "value": "Tuleap es una suite de c\u00f3digo abierto para mejorar la gesti\u00f3n de los desarrollos de software y la colaboraci\u00f3n. La contrase\u00f1a para conectar la instancia de Redis no se elimina del archivo generado con tuleap collect-system-data. Es probable que estos archivos los utilicen equipos de soporte que no deber\u00edan tener acceso a esta contrase\u00f1a. La vulnerabilidad se ha corregido en Tuleap Community Edition 16.4.99.1740492866 y Tuleap Enterprise Edition 16.4-6 y 16.3-11."}], "lastModified": "2025-08-22T15:53:42.620", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "44FFF09C-980B-4D7E-AF34-BBAECB1B179D", "versionEndExcluding": "16.3-11"}, {"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "66B57357-CED5-4841-90DE-FC45867C9D31", "versionEndExcluding": "16.4.99.1740492866"}, {"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "54A72640-277F-4E54-A2F4-8948FF0F16E2", "versionEndExcluding": "16.4-6", "versionStartIncluding": "16.4"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}