Unrated severityNVD Advisory· Published Mar 4, 2025· Updated Mar 4, 2025

Tuleap is missing CSRF protections on tracker fields administrative operations

CVE-2025-27402

Description

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap is missing CSRF protections on tracker fields administrative operations. An attacker could use this vulnerability to trick victims into removing or updating tracker fields. This vulnerability is fixed in Tuleap Community Edition 16.4.99.1740414959 and Tuleap Enterprise Edition 16.4-6 and 16.3-11.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Enalean/Tuleapllm-fuzzy2 versions
Community Edition < 16.4.99.1740414959, Enterprise Edition < 16.4-6 and < 16.3-11+ 1 more
- (no CPE)range: Community Edition < 16.4.99.1740414959, Enterprise Edition < 16.4-6 and < 16.3-11
- (no CPE)range: < 16.4.99.1740414959

Patches

Vulnerability mechanics

References

github.com/Enalean/tuleap/commit/ea6319e2ad40beeda335af4ccd7a204a6912765cmitrex_refsource_MISC
github.com/Enalean/tuleap/security/advisories/GHSA-66pg-cpjf-2mfgmitrex_refsource_CONFIRM
tuleap.net/plugins/tracker/mitrex_refsource_MISC

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000