Skip to main content

Tuleap CVE-2025-50179

| EUVDEUVD-2025-19103 MEDIUM
Cross-Site Request Forgery (CSRF) (CWE-352)
2025-06-25 security-advisories@github.com
CSRF Tuleap
4.6
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
4.6 MEDIUM
AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low

Lifecycle Timeline

4
EUVD ID Assigned
Mar 15, 2026 - 23:19 euvd
EUVD-2025-19103
Analysis Generated
Mar 15, 2026 - 23:19 vuln.today
Patch released
Mar 15, 2026 - 23:19 nvd
Patch available
CVE Published
Jun 25, 2025 - 16:15 nvd
MEDIUM 4.6

DescriptionGitHub Advisory

Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker could use a cross-site request forgery vulnerability in Tuleap Community Edition prior to version 16.8.99.1749830289 and Tuleap Enterprise Edition prior to version 16.9-1 to trick victims into changing the canned responses. Tuleap Community Edition 16.8.99.1749830289 and Tuleap Enterprise Edition 16.9-1 contain a patch for the issue.

Analysis

Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker could use a cross-site request forgery vulnerability in Tuleap Community Edition prior to version 16.8.99.1749830289 and Tuleap Enterprise Edition prior to version 16.9-1 to trick victims into changing the canned responses. Tuleap Community Edition 16.8.99.1749830289 and Tuleap Enterprise Edition 16.9-1 contain a patch for the issue.

Technical ContextAI

Cross-Site Request Forgery forces authenticated users to perform unintended actions by tricking their browser into sending forged requests. This vulnerability is classified as Cross-Site Request Forgery (CSRF) (CWE-352).

RemediationAI

A vendor patch is available — apply it immediately. Implement anti-CSRF tokens for all state-changing operations. Use SameSite cookie attribute. Verify the Origin/Referer header on the server side.

More in Tuleap

View all
CVE-2017-7411 HIGH POC
8.8 Oct 30

An issue was discovered in Enalean Tuleap 9.6 and prior versions. Rated high severity (CVSS 8.8), this vulnerability is

CVE-2014-8791 MEDIUM POC
6.0 Dec 02

project/register.php in Tuleap before 7.7, when sys_create_project_in_one_step is disabled, allows remote authenticated

CVE-2014-7178 CRITICAL POC
9.3 Nov 28

Enalean Tuleap before 7.5.99.6 allows remote attackers to execute arbitrary commands via the User-Agent header, which is
CVE-2017-7981 HIGH POC
8.8 Apr 29

Tuleap before 9.7 allows command injection via the PhpWiki 1.3.10 SyntaxHighlighter plugin. Rated high severity (CVSS 8.
CVE-2018-7538 CRITICAL POC
9.8 Mar 12

A SQL injection vulnerability in the tracker functionality of Enalean Tuleap software engineering platform before 9.18 a
CVE-2014-7176 MEDIUM POC
6.5 Nov 04

SQL injection vulnerability in Enalean Tuleap before 7.5.99.4 allows remote authenticated users to execute arbitrary SQL
CVE-2018-7634 HIGH POC
8.8 Mar 01

An issue was discovered in Enalean Tuleap 9.17. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitab
CVE-2021-41147 HIGH POC
7.2 Oct 15

Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. Rate
CVE-2014-7177 MEDIUM POC
4.0 Oct 31

XML External Entity vulnerability in Enalean Tuleap 7.2 and earlier allows remote authenticated users to read arbitrary

CVE-2018-17298 CRITICAL
9.8 Sep 21

An issue was discovered in Enalean Tuleap before 10.5. Rated critical severity (CVSS 9.8), this vulnerability is remotel
CVE-2024-46988 MEDIUM POC
5.7 Oct 14

Tuleap is a tool for end to end traceability of application and system developments. Rated medium severity (CVSS 5.7), t
CVE-2024-52599 MEDIUM POC
5.4 Dec 09

Tuleap is an open source suite to improve management of software developments and collaboration. Rated medium severity (

Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)

View all
CVE-2016-6277 HIGH POC
8.8
CVE-2014-100005 HIGH POC
8.0
CVE-2013-5696 MEDIUM POC
6.8
CVE-2020-36836 HIGH POC
8.0
CVE-2015-2295 MEDIUM POC
6.8
CVE-2016-6897 MEDIUM POC
6.5
CVE-2022-41622 HIGH POC
8.8
CVE-2025-2907 CRITICAL POC
9.8

Same technique CSRF

View all
CVE-2016-6277 HIGH POC
8.8
CVE-2014-100005 HIGH POC
8.0
CVE-2017-9757 HIGH POC
8.8
CVE-2013-5696 MEDIUM POC
6.8
CVE-2013-4152 MEDIUM POC
6.8
CVE-2024-7094 CRITICAL
9.8
CVE-2015-4624 HIGH POC
7.5
CVE-2020-36836 HIGH POC
8.0

Share

CVE-2025-50179 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy