CVE-2025-29929
Tuleap is missing CSRF protection on tracker hierarchy administration
- State
- Published
- Severity
- 4.6 Medium
- Published
- Mar 31, 2025
- Updated
- Mar 31, 2025
- Reserved
- Mar 12, 2025
Description
Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap is missing CSRF protection on tracker hierarchy administration. An attacker could use this vulnerability to trick victims into submitting or editing artifacts or follow-up comments. This vulnerability is fixed in Tuleap Community Edition 16.5.99.1742306712 and Tuleap Enterprise Edition 16.5-5 and 16.4-8.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.6 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L | GitHub_M |
Weaknesses
- CWE-352 Cross-Site Request Forgery (CSRF)
Affected Products
| Product | Versions |
|---|---|
tuleapEnalean |
|
References
- https://github.com/Enalean/tuleap/security/advisories/GHSA-hqqr-p5f6-26vv
- https://github.com/Enalean/tuleap/commit/dce61747f3a169da1f6b585ad5e6e0847fa3c950
- https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=dce61747f3a169da1f6b585ad5e6e0847fa3c950
- https://tuleap.net/plugins/tracker/?aid=42231
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.