CVE-2025-29766CWE-352

Tuleap has missing CSRF protections on artifact submission & edition from the tracker view

Medium · published March 31, 2025

CVSS v3.1
4.6
EPSS
0%
Percentile
9.3
In the wild
Unconfirmed
What it is

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap has missing CSRF protections on artifact submission & edition from the tracker view. An attacker could use this vulnerability to trick victims into submitting or editing artifacts or follow-up comments. The vulnerability is fixed in Tuleap Community Edition 16.5.99.1741784483 and Tuleap Enterprise Edition 16.5-3 and 16.4-8.

The record
Technical detail
CVSS v3.1
4.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00200 · 9.3th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2025-03-31T15:38Z
EPSS history
Timeline
  • 31 MAR 15:38Z
    Tuleap has missing CSRF protections on artifact submission & edition from the tracker view
    cvelistv5