PT-2025-49607 · Unknown · Tuleap Community Edition+1

Published 2025-12-08 · Updated 2025-12-08 · CVE-2025-64499

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Tuleap Community Edition versions prior to 17.0.99.1762456922 Tuleap Enterprise Edition versions prior to 17.0-2 Tuleap Enterprise Edition versions prior to 16.13-7 Tuleap Enterprise Edition versions prior to 16.12-10

Description Tuleap is a free and open source suite for management of software development and collaboration. The software is susceptible to Cross-Site Request Forgery (CSRF) attacks through the planning management API. Successful exploitation allows attackers to create, edit, or remove plans. The vulnerable API allows unauthorized actions on behalf of an authenticated user.

Recommendations Update Tuleap Community Edition to version 17.0.99.1762456922 or later. Update Tuleap Enterprise Edition to version 17.0-2 or later. Update Tuleap Enterprise Edition to version 16.13-7 or later. Update Tuleap Enterprise Edition to version 16.12-10 or later.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-64499

GHSA-9H47-JG7R-WW7X

Affected Products

Tuleap Community Edition

Tuleap Enterprise Edition

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64499.json · Exploit
• https://github.com/Enalean/tuleap/commit/1734a7bb2964042310ddc3f6dd7b4c82eee27526 · Patch
• https://github.com/Enalean/tuleap/security/advisories/GHSA-9h47-jg7r-ww7x · Vendor Advisory
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=1734a7bb2964042310ddc3f6dd7b4c82eee27526 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-64499 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64499 · Vendor Advisory
• https://tuleap.net/plugins/tracker/?aid=45592 · Vendor Advisory
• https://twitter.com/CVEnew/status/1998163809664634918 · Twitter Post
• https://t.me/cveNotify/145216 · Telegram Post