CVE-2025-27099

MEDIUM EPSS 19.4%
Published Mar 3, 20251y ago · Modified Jun 17, 20262w ago
4.8 CVSS 3.1
Medium
Find Similar
Published Mar 3, 2025 1y ago
Last Modified Jun 17, 2026 2w ago

Description

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap allows cross-site scripting (XSS) via the tracker names used in the semantic timeframe deletion message. A tracker administrator with a semantic timeframe used by other trackers could use this vulnerability to force other tracker administrators to execute uncontrolled code. This vulnerability is fixed in Tuleap Community Edition 16.4.99.1740067916 and Tuleap Enterprise Edition 16.4-5 and 16.3-10.

CVSS Details

Base Score
4.8
Exploitability
1.7
Impact
2.7
Vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction Required
Scope Changed
Confidentiality Low
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
19.4% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 2

CWE-79 Cross-site Scripting Injection
CWE-80

Affected Products 3

VendorProductVersionRange
enaleantuleap* <16.3-10
enaleantuleap* <16.4.99.1740067916
enaleantuleap*≥16.4  –  <16.4-5

References 3

  • github.com https://github.com/Enalean/tuleap/commit/bec10bd5c98f6570a2857f55e9656eec4b211e6c
    Patch
  • github.com https://github.com/Enalean/tuleap/security/advisories/GHSA-vqfj-2gqp-g89x
    PatchVendor Advisory
  • tuleap.net https://tuleap.net/plugins/tracker/?aid=41858
    ExploitIssue TrackingVendor Advisory

Remediation

  • github.com https://github.com/Enalean/tuleap/commit/bec10bd5c98f6570a2857f55e9656eec4b211e6c
    Patch
  • github.com https://github.com/Enalean/tuleap/security/advisories/GHSA-vqfj-2gqp-g89x
    PatchVendor Advisory