What is the CVSS score of CVE-2025-64498?

CVE-2025-64498 has a CVSS 3.1 base score of 4.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Tuleap are affected by CVE-2025-64498?

Organizations using Tuleap should be aware of moderate risk from CVE-2025-64498, a cross-site request forgery vulnerability rated CVSS 4.6. Users could be tricked into performing unintended actions.. A patch is available.

How to fix or mitigate CVE-2025-64498?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify anti-CSRF tokens are enforced.

Tuleap CVE-2025-64498

EUVD-2025-201838 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-12-08 security-advisories@github.com

CSRF Tuleap

4.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.6 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 17:54 euvd

EUVD-2025-201838

Analysis Generated

Mar 15, 2026 - 17:54 vuln.today

Patch released

Mar 15, 2026 - 17:54 nvd

Patch available

CVE Published

Dec 08, 2025 - 23:15 nvd

MEDIUM 4.6

DescriptionGitHub Advisory

Tuleap is an Open Source Suite for management of software development and collaboration. Tuleap Community Edition versions below 17.0.99.1762444754 and Tuleap Enterprise Edition versions prior to 17.0-2, 16.13-7 and 16.12-10 allow attackers trick victims into changing tracker general settings. This issue is fixed in version Tuleap Community Edition version 17.0.99.1762444754 and Tuleap Enterprise Edition versions 17.0-2, 16.13-7 and 16.12-10.

Analysis

Technical ContextAI

Cross-Site Request Forgery forces authenticated users to perform unintended actions by tricking their browser into sending forged requests. This vulnerability is classified as Cross-Site Request Forgery (CSRF) (CWE-352).

RemediationAI

A vendor patch is available — apply it immediately. Implement anti-CSRF tokens for all state-changing operations. Use SameSite cookie attribute. Verify the Origin/Referer header on the server side.

CVE-2025-64498 vulnerability details – vuln.today

Back