PT-2025-49609 · Unknown · Tuleap Community Edition+1

Published 2025-12-08 · Updated 2025-12-10 · CVE-2025-65962

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Tuleap Community Edition versions prior to 17.0.99.1763803709 Tuleap Enterprise Edition versions prior to 17.0-4 and 16.13-9

Description Tuleap, a free and open source suite for software development and collaboration, is affected by missing CSRF protections in its tracker field dependencies. This allows attackers to modify tracker fields.

Recommendations Update Tuleap Community Edition to version 17.0.99.1763803709. Update Tuleap Enterprise Edition to version 17.0-4. Update Tuleap Enterprise Edition to version 16.13-9.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-65962

GHSA-9HGC-CM68-RRGC

Affected Products

Tuleap Community Edition

Tuleap Enterprise Edition

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65962.json · Exploit
• https://github.com/Enalean/tuleap/commit/26678c5b411042e68964b199bf88a44607550633 · Patch
• https://github.com/Enalean/tuleap/security/advisories/GHSA-9hgc-cm68-rrgc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-65962 · Vendor Advisory
• https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=26678c5b411042e68964b199bf88a44607550633 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-65962 · Security Note
• https://tuleap.net/plugins/tracker/?aid=45632 · Vendor Advisory
• https://twitter.com/CVEnew/status/1998174132110819615 · Twitter Post
• https://t.me/cveNotify/145218 · Telegram Post
• https://t.me/CVEtracker/39175 · Telegram Post
• https://t.me/cveNotify/145394 · Telegram Post