PT-2025-9689 · Tuleap · Tuleap

Marie Ange Garnier + 1 · Published 2025-03-04 · Updated 2025-03-05 · CVE-2025-27401

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Tuleap versions prior to 16.4.99.1740498975 (Community Edition) Tuleap Enterprise Edition versions prior to 16.4-6 and 16.3-11

Description The issue has a limited impact in standard usage, mostly resulting in dangling data. However, a malicious user with access to one tracker could create and delete reports multiple times, cycling through all filters of all reports and deleting them, leading to the loss of all criteria filters. This would force users and tracker admins to re-create them.

Recommendations For Tuleap Community Edition versions prior to 16.4.99.1740498975, update to version 16.4.99.1740498975 or later. For Tuleap Enterprise Edition versions prior to 16.4-6, update to version 16.4-6 or later. For Tuleap Enterprise Edition version 16.3, update to version 16.3-11 or later.

Exploit

Fix

Weakness Enumeration

CWE-440

Related Identifiers

CVE-2025-27401

GHSA-3RJF-87RF-H8M9

Affected Products

Tuleap

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27401.json · Exploit
• https://github.com/Enalean/tuleap/security/advisories/GHSA-3rjf-87rf-h8m9 · Patch
• https://github.com/Enalean/tuleap/commit/0070fef5c3b27fd402d3232041c6e03f79a84ffd · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-27401 · Security Note
• https://osv.dev/vulnerability/CVE-2025-27401 · Vendor Advisory
• https://tuleap.net/plugins/tracker/?aid=41850 · Patch
• https://t.me/cvedetector/19528 · Telegram Post
• https://twitter.com/CVEnew/status/1897133275753119756 · Twitter Post