CVE-2025-27402

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap is missing CSRF protections on tracker fields administrative operations. An attacker could use this vulnerability to trick victims into removing or updating tracker fields. This vulnerability is fixed in Tuleap Community Edition 16.4.99.1740414959 and Tuleap Enterprise Edition 16.4-6 and 16.3-11.

CVSS v3 4.6 MEDIUM

4.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/Enalean/tuleap/commit/ea6319e2ad40beeda335af4ccd7a204a6912765c	Patch
https://github.com/Enalean/tuleap/security/advisories/GHSA-66pg-cpjf-2mfg	Third Party Advisory Patch
https://tuleap.net/plugins/tracker/?aid=41857	Vendor Advisory Issue Tracking

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:enalean:tuleap:::::enterprise:::*
	cpe:2.3:a:enalean:tuleap:::::community:::*
	cpe:2.3:a:enalean:tuleap:::::enterprise:::*

History

No history.

Information

Published : 2025-03-04 17:15

Updated : 2025-08-22 15:37

NVD link : CVE-2025-27402

Mitre link : CVE-2025-27402

CVE.ORG link : CVE-2025-27402

JSON object : View

Products Affected

enalean

tuleap

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2025-27402", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 2.5, "exploitabilityScore": 2.1}]}, "published": "2025-03-04T17:15:19.703", "references": [{"url": "https://github.com/Enalean/tuleap/commit/ea6319e2ad40beeda335af4ccd7a204a6912765c", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/Enalean/tuleap/security/advisories/GHSA-66pg-cpjf-2mfg", "tags": ["Third Party Advisory", "Patch"], "source": "[email protected]"}, {"url": "https://tuleap.net/plugins/tracker/?aid=41857", "tags": ["Vendor Advisory", "Issue Tracking"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap is missing CSRF protections on tracker fields administrative operations. An attacker could use this vulnerability to trick victims into removing or updating tracker fields. This vulnerability is fixed in Tuleap Community Edition 16.4.99.1740414959 and Tuleap Enterprise Edition 16.4-6 and 16.3-11."}, {"lang": "es", "value": "Tuleap es una suite de c\u00f3digo abierto para mejorar la gesti\u00f3n de los desarrollos de software y la colaboraci\u00f3n. Tuleap carece de protecciones CSRF en las operaciones administrativas de los campos de seguimiento. Un atacante podr\u00eda usar esta vulnerabilidad para enga\u00f1ar a las v\u00edctimas para que eliminen o actualicen los campos de seguimiento. Esta vulnerabilidad se ha corregido en Tuleap Community Edition 16.4.99.1740414959 y Tuleap Enterprise Edition 16.4-6 y 16.3-11."}], "lastModified": "2025-08-22T15:37:24.217", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "44FFF09C-980B-4D7E-AF34-BBAECB1B179D", "versionEndExcluding": "16.3-11"}, {"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "54F4752E-8902-4178-B22B-C562F962DDDD", "versionEndExcluding": "16.4.99.1740414959"}, {"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "54A72640-277F-4E54-A2F4-8948FF0F16E2", "versionEndExcluding": "16.4-6", "versionStartIncluding": "16.4"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}