CVE-2025-30203

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap allows cross-site scripting (XSS) via the content of RSS feeds in the RSS widgets. A project administrator or someone with control over an used RSS feed could use this vulnerability to force victims to execute uncontrolled code. This vulnerability is fixed in Tuleap Community Edition 16.5.99.1742562878 and Tuleap Enterprise Edition 16.5-5 and 16.4-8.

CVSS v3 4.8 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.7 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://github.com/Enalean/tuleap/commit/54cce3f5e883d16055cb0239e023f48cdf5eb25f	Patch
https://github.com/Enalean/tuleap/security/advisories/GHSA-39gx-34fc-rx6r	Third Party Advisory
https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=54cce3f5e883d16055cb0239e023f48cdf5eb25f	Broken Link
https://tuleap.net/plugins/tracker/?aid=42243	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:enalean:tuleap:::::enterprise:::*
	cpe:2.3:a:enalean:tuleap:::::community:::*
	cpe:2.3:a:enalean:tuleap:::::enterprise:::*

History

No history.

Information

Published : 2025-03-31 16:15

Updated : 2025-08-21 22:03

NVD link : CVE-2025-30203

Mitre link : CVE-2025-30203

CVE.ORG link : CVE-2025-30203

JSON object : View

Products Affected

enalean

tuleap

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-84

Improper Neutralization of Encoded URI Schemes in a Web Page

{"id": "CVE-2025-30203", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 2.7, "exploitabilityScore": 1.7}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}]}, "published": "2025-03-31T16:15:25.473", "references": [{"url": "https://github.com/Enalean/tuleap/commit/54cce3f5e883d16055cb0239e023f48cdf5eb25f", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/Enalean/tuleap/security/advisories/GHSA-39gx-34fc-rx6r", "tags": ["Third Party Advisory"], "source": "[email protected]"}, {"url": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=54cce3f5e883d16055cb0239e023f48cdf5eb25f", "tags": ["Broken Link"], "source": "[email protected]"}, {"url": "https://tuleap.net/plugins/tracker/?aid=42243", "tags": ["Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-84"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap allows cross-site scripting (XSS) via the content of RSS feeds in the RSS widgets. A project administrator or someone with control over an used RSS feed could use this vulnerability to force victims to execute uncontrolled code. This vulnerability is fixed in Tuleap Community Edition 16.5.99.1742562878 and Tuleap Enterprise Edition 16.5-5 and 16.4-8."}, {"lang": "es", "value": "Tuleap es una suite de c\u00f3digo abierto que mejora la gesti\u00f3n del desarrollo de software y la colaboraci\u00f3n. Tuleap permite el uso de cross-site scripting (XSS) a trav\u00e9s del contenido de las fuentes RSS en los widgets RSS. Un administrador de proyecto o alguien con control sobre una fuente RSS en uso podr\u00eda aprovechar esta vulnerabilidad para obligar a las v\u00edctimas a ejecutar c\u00f3digo no controlado. Esta vulnerabilidad est\u00e1 corregida en Tuleap Community Edition 16.5.99.1742562878 y Tuleap Enterprise Edition 16.5-5 y 16.4-8."}], "lastModified": "2025-08-21T22:03:06.790", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "C9A97892-5CD1-4264-BBDE-843B91161A62", "versionEndExcluding": "16.4-8"}, {"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "3D1C190B-9ADD-4E3F-9A43-8ECCE8FB1C94", "versionEndExcluding": "16.5.99.1742562878"}, {"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "E08117D5-6EA5-490F-B78D-8EFDE5025837", "versionEndExcluding": "16.5-5", "versionStartIncluding": "16.5"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}