CVE-2025-27402

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-27402
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-27402.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-27402
Aliases
  • GHSA-66pg-cpjf-2mfg
Published
2025-03-04T17:00:49.077Z
Modified
2026-04-10T05:24:12.167534Z
Severity
  • 4.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L CVSS Calculator
Summary
Tuleap is missing CSRF protections on tracker fields administrative operations
Details

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap is missing CSRF protections on tracker fields administrative operations. An attacker could use this vulnerability to trick victims into removing or updating tracker fields. This vulnerability is fixed in Tuleap Community Edition 16.4.99.1740414959 and Tuleap Enterprise Edition 16.4-6 and 16.3-11.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27402.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-352"
    ]
}
References

Affected packages

Git / github.com/enalean/tuleap

Affected ranges

Type
GIT
Repo
https://github.com/enalean/tuleap
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ea6319e2ad40beeda335af4ccd7a204a6912765c

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-27402.json"
unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "16.3-11"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "16.4.99.1740414959"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "16.4"
            },
            {
                "fixed": "16.4-6"
            }
        ]
    }
]