PT-2025-46724 · Unknown · Subversion+2

Published 2025-11-12 · Updated 2025-11-13 · CVE-2025-64482

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Tuleap Community Edition versions prior to 16.13.99.1762267347 Tuleap Enterprise Edition versions prior to 17.01 Tuleap Enterprise Edition versions prior to 16.13-6 Tuleap Enterprise Edition versions prior to 16.12-9

Description Tuleap is an Open Source Suite designed to improve software development management and collaboration. The file release system lacks cross-site request forgery protections. An attacker could exploit this to trick users into modifying commit rules or immutable tags within a Subversion repository. The affected functionality involves manipulating SVN repositories.

Recommendations Update Tuleap Community Edition to version 16.13.99.1762267347 or later. Update Tuleap Enterprise Edition to version 17.01 or later. Update Tuleap Enterprise Edition to version 16.13-6 or later. Update Tuleap Enterprise Edition to version 16.12-9 or later.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-64482

GHSA-W7H4-9VF6-Q7RC

Affected Products

Subversion

Tuleap Community Edition

Tuleap Enterprise Edition

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64482.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-64482 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64482 · Security Note
• https://github.com/Enalean/tuleap/commit/899b5c1693324211947b72f2810ae8944e1bd0d5 · Note
• https://github.com/Enalean/tuleap/security/advisories/GHSA-w7h4-9vf6-q7rc · Note
• https://t.me/CVEtracker/37189 · Telegram Post
• https://twitter.com/CVEnew/status/1988820459153158524 · Twitter Post
• https://tuleap.net/plugins/tracker/?aid=45259 · Note
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=899b5c1693324211947b72f2810ae8944e1bd0d5 · Note
• https://twitter.com/VulmonFeeds/status/1988797882707677433 · Twitter Post