PT-2025-9690 · Tuleap · Tuleap

Tgerbet + 1 · Publicado 2025-03-04 · Atualizado 2025-08-22 · CVE-2025-27402

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Tuleap versions prior to 16.4.99.1740414959 Tuleap Enterprise Edition versions prior to 16.4-6 and 16.3-11

Description The issue is related to the lack of CSRF protections on tracker fields administrative operations in Tuleap. This allows an attacker to trick victims into removing or updating tracker fields.

Recommendations For Tuleap Community Edition versions prior to 16.4.99.1740414959, update to version 16.4.99.1740414959 or later. For Tuleap Enterprise Edition versions prior to 16.4-6, update to version 16.4-6 or later. For Tuleap Enterprise Edition versions prior to 16.3-11, update to version 16.3-11 or later.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2025-27402

GHSA-66PG-CPJF-2MFG

Produtos afetados

Tuleap

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27402.json · Exploit
• https://github.com/Enalean/tuleap/security/advisories/GHSA-66pg-cpjf-2mfg · Correção
• https://github.com/Enalean/tuleap/commit/ea6319e2ad40beeda335af4ccd7a204a6912765c · Correção
• https://t.me/cveNotify/133187 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-27402 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-27402 · Nota de Segurança
• https://t.me/cvedetector/19529 · Publicação no Telegram
• https://tuleap.net/plugins/tracker/?aid=41857 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1897133274763252045 · Publicação no Twitter