4.6

CVE-2025-64482

Tuleap missing CSRF protections in the File Release System

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap Community Edition prior to version 16.13.99.1762267347 and Tuleap Enterprise Edition prior to versions 17.01-, 16.13-6, and 16.12-9 don't have cross-site request forgery protections in the file release system. An attacker could use this vulnerability to trick victims into changing the commit rules or immutable tags of a SVN repo. Tuleap Community Edition 16.13.99.1762267347, Tuleap Enterprise Edition 17.0-1, Tuleap Enterprise Edition 16.13-6, and Tuleap Enterprise Edition 16.12-9 fix the issue.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerEnalean
≫
Produkt tuleap
Version Tuleap Community Edition < 16.13.99.1762267347
Status affected
Version Tuleap Enterprise Edition < 17.0-1
Status affected
Version Tuleap Enterprise Edition < 16.13-6
Status affected
Version Tuleap Enterprise Edition < 16.12-9
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.12% 0.02
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security-advisories@github.com 4.6 2.1 2.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
CWE-352 Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

https://github.com/Enalean/tuleap/security/advisories/GHSA-w7h4-9vf6-q7rc
https://github.com/Enalean/tuleap/commit/899b5c1693324211947b72f2810ae8944e1bd0d5
https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=899b5c1693324211947b72f2810ae8944e1bd0d5
https://tuleap.net/plugins/tracker/?aid=45259