CVE-2025-48991

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-48991
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48991.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-48991
Aliases
  • GHSA-px9r-875r-w534
Published
2025-06-25T14:07:47.416Z
Modified
2026-04-10T05:29:02.319389Z
Severity
  • 4.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L CVSS Calculator
Summary
Tuleap missing CSRF protection on tracker canned responses administration
Details

Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker could use a vulnerability present in Tuleap Community Edition prior to version 16.8.99.1748845907 and Tuleap Enterprise Edition prior to versions 16.8-3 and 16.7-5 to trick victims into changing the canned responses. Tuleap Community Edition 16.8.99.1748845907, Tuleap Enterprise Edition 16.8-3, and Tuleap Enterprise Edition 16.7-5 contain a fix for the vulnerability.

Database specific 
{
    "cwe_ids": [
        "CWE-352"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48991.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/enalean/tuleap

Affected ranges

Type
GIT
Repo
https://github.com/enalean/tuleap
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
cbf9b2a38e33dfd755dc2ccf074126b598a78274

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48991.json"
unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "16.7-5"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "16.8.99.1748845907"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "16.8"
            },
            {
                "fixed": "16.8-3"
            }
        ]
    }
]