4.6

CVE-2025-64117

Tuleap missing CSRF protection in the management of SVN commit rules and immutable tags

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap Community Edition prior to version 16.13.99.1761813675 and Tuleap Enterprise Edition prior to versions 16.13-5 and 16.12-8 don't have cross-site request forgery protection in the management of SVN commit rules and immutable tags. An attacker could use this vulnerability to trick victims into changing the commit rules or immutable tags of a SVN repo. Tuleap Community Edition 16.13.99.1761813675, Tuleap Enterprise Edition 16.13-5, and Tuleap Enterprise Edition 16.12-8 contain a fix for the issue.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerEnalean
≫
Produkt tuleap
Version Tuleap Community Edition < 16.13.99.1761813675
Status affected
Version Tuleap Enterprise Edition < 16.13-5
Status affected
Version Tuleap Enterprise Edition < 16.12-8
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.12% 0.02
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 4.6 2.1 2.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

https://github.com/Enalean/tuleap/security/advisories/GHSA-p2f7-qw8p-f2p7
https://github.com/Enalean/tuleap/commit/f49419f63edbbaa31ce8417b737431d944827404
https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=f49419f63edbbaa31ce8417b737431d944827404
https://tuleap.net/plugins/tracker/?aid=45251