Tuleap CVE-2025-64499

Exploitation requires the planning management API of Tuleap (Community Edition before 17.0.99.1762456922, or Enterprise Edition before 17.0-2, 16.13-7, and 16.12-10) and depends on a victim who is already authenticated to the Tuleap instance being tricked into visiting attacker-controlled content (UI:R) - the forged request executes with the victim's existing session and privileges. Limiting factors: the attack cannot succeed without an active, logged-in Tuleap user with sufficient rights over planning data, requires social-engineering to deliver the request, and is neutralized by upgrading to the fixed versions; there is no confidentiality exposure and impact is bounded to manipulation/removal of planning entries.

This is a moderate-severity CSRF vulnerability (CWE-352) with an official CVSS 3.1 score of 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L), confirming network-reachable but user-interaction-dependent exploitation with no confidentiality impact and only low integrity/availability impact (attacker can create, edit, or remove planning entries). All exploitation signals point toward low real-world urgency: EPSS is just 0.02% (5th percentile), the CVE is NOT on the CISA KEV list, and no public proof-of-concept is referenced. Exploitation status is therefore 'no public exploit identified at time of analysis.' The PR:N metric reflects CSRF semantics - the attacker holds no privileges but rides a logged-in victim's session - and UI:R correctly captures the need for an authenticated Tuleap user to be socially engineered into triggering the request. The signals are internally consistent (low EPSS, no KEV, CSRF with partial impact and required interaction all agree this is a genuine-but-low priority fix), with no contradictions between the CVSS vector and the description. A vendor patch is confirmed available, so remediation is straightforward.

An attacker crafts a malicious web page or email containing a hidden request targeting Tuleap's planning management API and lures an authenticated Tuleap user (ideally one with planning privileges) into visiting it. The victim's browser silently submits the forged request using their valid session, allowing the attacker to create, modify, or delete planning entries without the user's knowledge. No public exploit code is identified, so an attacker would need to develop the CSRF payload themselves.