Tuleap CVE-2025-65962

Exploitation requires a victim who is already authenticated to the target Tuleap instance and holds permissions to modify tracker field dependencies, and who must be tricked into visiting an attacker-controlled page while that session is active (UI:R). The vulnerable surface is specifically the tracker field-dependencies feature, which lacked anti-CSRF token validation in Tuleap Community Edition before 17.0.99.1763803709 and Enterprise before 17.0-4 and 16.13-9. Limiting factors: no attacker authentication is needed but the attack fails without an authenticated, sufficiently-privileged victim and without that victim interacting with the malicious content; impact is confined to tracker field modification (integrity), with no data disclosure or service disruption.

This is a genuinely low-priority, low-severity issue despite being network-exploitable. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, base 4.3) reflects a classic CSRF (CWE-352): network reachable and low-complexity, but it requires user interaction (UI:R) and yields only limited integrity impact (I:L) with no confidentiality or availability impact. The PR:N applies to the attacker, but exploitation depends on an already-authenticated victim, which is the normal CSRF model. All signals align on low real-world risk: EPSS is 0.16% (5th percentile), there is no CISA KEV listing, and no public exploit code is referenced in the input. No SSVC decision data was provided. The signals are consistent with one another - low exploitation probability, no active exploitation, modest impact - so this reads as a legitimate but low-urgency hardening fix rather than an emergency. Patch application during normal maintenance is appropriate.

An attacker crafts a malicious web page containing a forged request to a Tuleap tracker's field-dependency endpoint and lures an authenticated Tuleap user into visiting it. Because the tracker field-dependency function lacks CSRF protection, the victim's browser silently submits the request using their active session, modifying tracker field configurations without consent. No public exploit code is identified at time of analysis, but CSRF of this kind is trivial to construct.