PT-2025-46700 · Unknown · Tuleap Community Edition+2

Published 2025-11-12 · Updated 2025-11-12 · CVE-2025-64117

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Tuleap Community Edition versions prior to 16.13.99.1761813675 Tuleap Enterprise Edition versions prior to 16.13-5 and 16.12-8

Description Tuleap lacks cross-site request forgery (CSRF) protection in the management of Subversion (SVN) commit rules and immutable tags. An attacker could exploit this to trick users into modifying the commit rules or immutable tags of an SVN repository. Cross-site request forgery is a type of web security flaw that allows an attacker to induce a user to perform actions on a web application in which they are currently authenticated.

Recommendations Tuleap Community Edition versions prior to 16.13.99.1761813675 should be updated to version 16.13.99.1761813675 or later. Tuleap Enterprise Edition versions prior to 16.13-5 should be updated to version 16.13-5 or later. Tuleap Enterprise Edition versions prior to 16.12-8 should be updated to version 16.12-8 or later.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-64117

GHSA-P2F7-QW8P-F2P7

Affected Products

Subversion

Tuleap Community Edition

Tuleap Enterprise Edition

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64117.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-64117 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64117 · Security Note
• https://github.com/Enalean/tuleap/security/advisories/GHSA-p2f7-qw8p-f2p7 · Note
• https://github.com/Enalean/tuleap/commit/f49419f63edbbaa31ce8417b737431d944827404 · Note
• https://tuleap.net/plugins/tracker/?aid=45251 · Note
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=f49419f63edbbaa31ce8417b737431d944827404 · Note
• https://twitter.com/CVEnew/status/1988721709579391125 · Twitter Post