CVE-2025-29929CWE-352

Tuleap is missing CSRF protection on tracker hierarchy administration

Medium · published March 31, 2025

CVSS v3.1
4.6
EPSS
0%
Percentile
8.8
In the wild
Unconfirmed
What it is

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap is missing CSRF protection on tracker hierarchy administration. An attacker could use this vulnerability to trick victims into submitting or editing artifacts or follow-up comments. This vulnerability is fixed in Tuleap Community Edition 16.5.99.1742306712 and Tuleap Enterprise Edition 16.5-5 and 16.4-8.

The record
Technical detail
CVSS v3.1
4.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00196 · 8.8th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2025-03-31T15:40Z
EPSS history
Timeline
  • 31 MAR 15:40Z
    Tuleap is missing CSRF protection on tracker hierarchy administration
    cvelistv5