PT-2025-9688 · Tuleap · Tuleap

Lesuisse · Publicado 2025-03-04 · Atualizado 2025-03-05 · CVE-2025-27156

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Tuleap versions prior to 16.4.99.1740567344 Tuleap Enterprise Edition versions prior to 16.4-6 and 16.3-11

Description The mass emailing feature in Tuleap does not properly sanitize the content of HTML emails. This could allow a malicious user to facilitate phishing attempts or indirectly exploit issues in the recipients' mail clients.

Recommendations For Tuleap Community Edition versions prior to 16.4.99.1740567344, update to version 16.4.99.1740567344 or later. For Tuleap Enterprise Edition versions prior to 16.4-6, update to version 16.4-6 or later. For Tuleap Enterprise Edition version 16.3, update to version 16.3-11 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-27156

GHSA-X2V2-XR59-C9CF

Produtos afetados

Tuleap

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27156.json · Exploit
• https://github.com/Enalean/tuleap/commit/a0bc657297b405debce1f5bcbbb30c733f3f09bd · Correção
• https://github.com/Enalean/tuleap/security/advisories/GHSA-x2v2-xr59-c9cf · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2025-27156 · Nota de Segurança
• https://tuleap.net/plugins/tracker/?aid=42177 · Correção
• https://twitter.com/VulmonFeeds/status/1896991037622505764 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-27156 · Aviso do Fabricante
• https://t.me/cvedetector/19534 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1897133276667449520 · Publicação no Twitter