Tuleap has a Cross-Site Request Forgery (CSRF) vulnerability

4.6 CVSS

Vulnerability Description

Tuleap is an Open Source Suite for management of software development and collaboration. Tuleap Community Edition versions below 17.0.99.1762444754 and Tuleap Enterprise Edition versions prior to 17.0-2, 16.13-7 and 16.12-10 allow attackers trick victims into changing tracker general settings. This issue is fixed in version Tuleap Community Edition version 17.0.99.1762444754 and Tuleap Enterprise Edition versions 17.0-2, 16.13-7 and 16.12-10.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-64498

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from Enalean

View All →

CVE-2025-65962

Tuleap has missing CSRF protections its in tracker field dependencies

Medium 4.6

CVE-2025-64760

Tuleap has missing CSRF protections in its tracker trigger management system

Medium 4.6

CVE-2025-64499

Tuleap is missing CSRF protections for its planning management API

Medium 4.6

CVE-2025-64497

Tuleap exposes releases for all projects to File Release System project administrators

Medium 6.5

CVE-2025-64482

Tuleap missing CSRF protections in the File Release System

Medium 4.6

Affected Vendor

Enalean

View all reports →

Affected Software

tuleap

Vulnerable Versions:

Tuleap Community Edition < 17.0.99.1762444754, Tuleap Enterprise Edition < 17.0-2, Tuleap Enterprise Edition < 16.13-7, Tuleap Enterprise Edition < 16.12-10