Tuleap is missing CSRF protections for its planning management API

4.6 CVSS

Vulnerability Description

Tuleap is a free and open source suite for management of software development and collaboration. Tuleap Community Editon versions prior to 17.0.99.1762456922 and Tuleap Enterprise Edition versions prior to 17.0-2, 16.13-7 and 16.12-10 are vulnerable to CSRF attacks through planning management API. Attackers have access to create, edit or remove plans. This issue is fixed in Tuleap Community Edition version 17.0.99.1762456922 and Tuleap Enterprise Edtion versions 17.0-2, 16.13-7 and 16.12-10.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-64499

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from Enalean

View All →

CVE-2025-65962

Tuleap has missing CSRF protections its in tracker field dependencies

Medium 4.6

CVE-2025-64760

Tuleap has missing CSRF protections in its tracker trigger management system

Medium 4.6

CVE-2025-64498

Tuleap has a Cross-Site Request Forgery (CSRF) vulnerability

Medium 4.6

CVE-2025-64497

Tuleap exposes releases for all projects to File Release System project administrators

Medium 6.5

CVE-2025-64482

Tuleap missing CSRF protections in the File Release System

Medium 4.6

Affected Vendor

Enalean

View all reports →

Affected Software

tuleap

Vulnerable Versions:

Tuleap Community Edition < 17.0.99.1762456922, Tuleap Enterprise Edition < 17.0-2, Tuleap Enterprise Edition < 16.13-7, Tuleap Enterprise Edition < 16.12-10