PT-2025-38408 · Unknown · Tuleap Community Edition+1

Lesuisse · Publicado 2025-09-18 · Atualizado 2025-09-18 · CVE-2025-59040

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tuleap Community Edition versions prior to 16.11.99.1757427600 Tuleap Enterprise Edition versions prior to 16.11-6 Tuleap Enterprise Edition version 16.10-8

Description Backlog item representations do not verify the permissions of child trackers, potentially allowing users to view tracker names they should not have access to.

Recommendations Update Tuleap Community Edition to version 16.11.99.1757427600. Update Tuleap Enterprise Edition to version 16.11-6. Update Tuleap Enterprise Edition to version 16.10-8.

Exploit

Correção

Enumeração de Fraquezas

CWE-280

Identificadores relacionados

CVE-2025-59040

GHSA-67XC-39V9-PFFG

Produtos afetados

Tuleap Community Edition

Tuleap Enterprise Edition

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59040.json · Exploit
• https://github.com/Enalean/tuleap/commit/92e4aa2d830a624a9183206c1c3558b90b8a5525 · Nota
• https://github.com/Enalean/tuleap/security/advisories/GHSA-67xc-39v9-pffg · Nota
• https://twitter.com/CVEnew/status/1968718091862564928 · Publicação no Twitter
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=92e4aa2d830a624a9183206c1c3558b90b8a5525 · Nota
• https://osv.dev/vulnerability/CVE-2025-59040 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-59040 · Nota de Segurança
• https://tuleap.net/plugins/tracker/?aid=44489 · Nota