PT-2025-9687 · Unknown+2 · Tuleap Enterprise Edition+2

Tgerbet + 1 · Publicado 2025-03-04 · Atualizado 2025-08-22 · CVE-2025-27150

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tuleap versions prior to 16.4.99.1740492866 Tuleap Enterprise Edition versions prior to 16.4-6 and 16.3-11

Description The issue concerns the management of sensitive information, specifically the password for connecting to the Redis instance, which is not properly removed from system data archives generated by the tuleap collect-system-data command. These archives may be accessed by support teams, who should not have access to this password.

Recommendations For Tuleap versions prior to 16.4.99.1740492866, update to version 16.4.99.1740492866 or later. For Tuleap Enterprise Edition versions prior to 16.4-6, update to version 16.4-6 or later. For Tuleap Enterprise Edition version 16.3, update to version 16.3-11 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-538

Identificadores relacionados

CVE-2025-27150

GHSA-JC5R-684X-J46Q

Produtos afetados

Redis

Tuleap

Tuleap Enterprise Edition

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27150.json · Exploit
• https://github.com/Enalean/tuleap/commit/a6702622a8db969a17522b8fac0774afdb1c916f · Correção
• https://github.com/Enalean/tuleap/security/advisories/GHSA-jc5r-684x-j46q · Correção
• https://t.me/cveNotify/133186 · Publicação no Telegram
• https://tuleap.net/plugins/tracker/?aid=41870 · Correção
• https://twitter.com/CVEnew/status/1897133277569319222 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-27150 · Aviso do Fabricante
• https://t.me/cvedetector/19532 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-27150 · Nota de Segurança