CVE-2025-27402CWE-352

Tuleap is missing CSRF protections on tracker fields administrative operations

Medium · published March 4, 2025

CVSS v3.1
4.6
EPSS
0%
Percentile
5.7
In the wild
Unconfirmed
What it is

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap is missing CSRF protections on tracker fields administrative operations. An attacker could use this vulnerability to trick victims into removing or updating tracker fields. This vulnerability is fixed in Tuleap Community Edition 16.4.99.1740414959 and Tuleap Enterprise Edition 16.4-6 and 16.3-11.

The record
Technical detail
CVSS v3.1
4.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00167 · 5.7th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2025-03-04T17:00Z
EPSS history
Timeline
  • 04 MAR 17:00Z
    Tuleap is missing CSRF protections on tracker fields administrative operations
    cvelistv5