Joris Masson

**Name of the Vulnerable Software and Affected Versions** Tuleap Community Edition versions prior to 17.0.99.1768924735 Tuleap Enterprise Edition versions 17.2-5, 17.1-6, and 17.0-9 **Description** Tuleap lacks CSRF protection in the Overview inconsistent items feature. An attacker could exploit this to trick users into creating artifact links from the release by repairing inconsistent items. The vulnerability allows an attacker to perform actions on behalf of an authenticated user without their knowledge. **Recommendations** Update Tuleap Community Edition to version 17.0.99.1768924735 or later. Update Tuleap Enterprise Edition to version 17.2-5, 17.1-6, or 17.0-9 or later.

**Name of the Vulnerable Software and Affected Versions** Tuleap versions prior to 16.5.99.1742306712 Tuleap Enterprise Edition versions prior to 16.5-5 and 16.4-8 **Description** The issue is related to the lack of CSRF protection on tracker hierarchy administration. An attacker could exploit this to trick victims into submitting or editing artifacts or follow-up comments. **Recommendations** For Tuleap Community Edition versions prior to 16.5.99.1742306712, update to version 16.5.99.1742306712 or later. For Tuleap Enterprise Edition versions prior to 16.5-5, update to version 16.5-5 or later. For Tuleap Enterprise Edition version 16.4, update to version 16.4-8 or later.

**Name of the Vulnerable Software and Affected Versions** Tuleap versions prior to 16.5.99.1742392651 Tuleap Enterprise Edition versions prior to 16.5-5 and 16.4-8 **Description** The issue concerns the lack of enforcement of read permissions on parent trackers in the REST API. This affects the management of software developments and collaboration. **Recommendations** For Tuleap Community Edition versions prior to 16.5.99.1742392651, update to version 16.5.99.1742392651 or later. For Tuleap Enterprise Edition versions prior to 16.5-5, update to version 16.5-5 or later. For Tuleap Enterprise Edition versions prior to 16.4-8, update to version 16.4-8 or later. As a temporary workaround, consider restricting access to the REST API until a patch is applied.