PT-2025-9687 · Unknown+2 · Tuleap Enterprise Edition+2

Tgerbet + 1 · Published 2025-03-04 · Updated 2025-08-22 · CVE-2025-27150

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tuleap versions prior to 16.4.99.1740492866 Tuleap Enterprise Edition versions prior to 16.4-6 and 16.3-11

Description The issue concerns the management of sensitive information, specifically the password for connecting to the Redis instance, which is not properly removed from system data archives generated by the tuleap collect-system-data command. These archives may be accessed by support teams, who should not have access to this password.

Recommendations For Tuleap versions prior to 16.4.99.1740492866, update to version 16.4.99.1740492866 or later. For Tuleap Enterprise Edition versions prior to 16.4-6, update to version 16.4-6 or later. For Tuleap Enterprise Edition version 16.3, update to version 16.3-11 or later.

Exploit

Fix

Weakness Enumeration

CWE-538

Related Identifiers

CVE-2025-27150

GHSA-JC5R-684X-J46Q

Affected Products

Redis

Tuleap

Tuleap Enterprise Edition

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27150.json · Exploit
• https://github.com/Enalean/tuleap/commit/a6702622a8db969a17522b8fac0774afdb1c916f · Patch
• https://github.com/Enalean/tuleap/security/advisories/GHSA-jc5r-684x-j46q · Patch
• https://tuleap.net/plugins/tracker/?aid=41870 · Patch
• https://osv.dev/vulnerability/CVE-2025-27150 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27150 · Security Note
• https://t.me/cveNotify/133186 · Telegram Post
• https://twitter.com/CVEnew/status/1897133277569319222 · Twitter Post
• https://t.me/cvedetector/19532 · Telegram Post