CVE-2025-52899CWE-204

Tuleap vulnerable to user enumeration via the lost password form

Medium · published July 29, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
23.6
In the wild
Unconfirmed
What it is

Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition prior to version 16.9.99.1750843170 and Tuleap Enterprise Edition prior to 16.8-4 and 16.9-2, the forgot password form allows for user enumeration. This is fixed in Tuleap Community Edition version 16.9.99.1750843170 and Tuleap Enterprise Edition 16.8-4 and 16.9-2.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00319 · 23.6th percentile
Weakness
CWE-204 · Observable Response Discrepancy
Published
2025-07-29T19:16Z
EPSS history
Timeline
  • 29 JUL 19:16Z
    Tuleap vulnerable to user enumeration via the lost password form
    cvelistv5