CVE-2025-64760

MEDIUM EPSS 2.1%
Published Dec 8, 20256mo ago · Modified Jun 17, 20262w ago
4.3 CVSS 3.1
Medium
Find Similar
Published Dec 8, 2025 6mo ago
Last Modified Jun 17, 2026 2w ago

Description

Tuleap is a free and open source suite for management of software development and collaboration. Versions of Tuleap Community Edition prior to 17.0.99.1763126988 and Tuleap Enterprise Edition prior to 17.0-3 and 16.13-8 have missing CSRF protections which allow attackers to create or remove tracker triggers. This issue is fixed in Tuleap Community Edition version 17.0.99.1763126988 and Tuleap Enterprise Edition versions 17.0-3 and 16.13-8.

CVSS Details

Base Score
4.3
Exploitability
2.8
Impact
1.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality None
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
2.1% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-352 Cross-Site Request Forgery (CSRF) Authentication

Affected Products 3

VendorProductVersionRange
enaleantuleap* <16.13-8
enaleantuleap* <17.0.99.1763126988
enaleantuleap*≥17.0  –  <17.0-3

References 4

  • github.com https://github.com/Enalean/tuleap/commit/71d427b0f7ed8fa269a5ee6f7a557cf3dfc99cd4
    Patch
  • github.com https://github.com/Enalean/tuleap/security/advisories/GHSA-f2xv-x3g6-4j9p
    Vendor Advisory
  • tuleap.net https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=71d427b0f7ed8fa269a5ee6f7a557cf3dfc99cd4
    Broken LinkPatch
  • tuleap.net https://tuleap.net/plugins/tracker/?aid=45618
    Issue TrackingVendor Advisory

Remediation

  • github.com https://github.com/Enalean/tuleap/commit/71d427b0f7ed8fa269a5ee6f7a557cf3dfc99cd4
    Patch
  • tuleap.net https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=71d427b0f7ed8fa269a5ee6f7a557cf3dfc99cd4
    Broken LinkPatch