PT-2025-13789 · Tuleap · Tuleap

Tgerbet + 1 · Published 2025-03-31 · Updated 2025-08-21 · CVE-2025-30203

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Tuleap versions prior to 16.5.99.1742562878 Tuleap Enterprise Edition versions prior to 16.5-5 and 16.4-8

Description The issue allows cross-site scripting (XSS) via the content of RSS feeds in the RSS widgets. A project administrator or someone with control over an used RSS feed could use this to force victims to execute uncontrolled code.

Recommendations For Tuleap Community Edition versions prior to 16.5.99.1742562878, update to version 16.5.99.1742562878 or later. For Tuleap Enterprise Edition versions prior to 16.5-5, update to version 16.5-5 or later. For Tuleap Enterprise Edition versions prior to 16.4-8, update to version 16.4-8 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-84

CWE-79

Related Identifiers

CVE-2025-30203

GHSA-39GX-34FC-RX6R

Affected Products

Tuleap

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30203.json · Exploit
• https://github.com/Enalean/tuleap/commit/54cce3f5e883d16055cb0239e023f48cdf5eb25f · Patch
• https://tuleap.net/plugins/tracker/?aid=42243 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-30203 · Security Note
• https://osv.dev/vulnerability/CVE-2025-30203 · Vendor Advisory
• https://github.com/Enalean/tuleap/security/advisories/GHSA-39gx-34fc-rx6r · Note
• https://twitter.com/VulmonFeeds/status/1906878141601112219 · Twitter Post
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=54cce3f5e883d16055cb0239e023f48cdf5eb25f · Note
• https://t.me/cvedetector/21618 · Telegram Post
• https://t.me/cveNotify/133126 · Telegram Post
• https://t.me/cvetracker/20362 · Telegram Post
• https://twitter.com/CVEnew/status/1906742930255102005 · Twitter Post