Tuleap EUVD-2025-201838

Exploitation requires that a victim already authenticated to Tuleap - and holding sufficient permissions to modify a tracker's general settings - be tricked into interacting with attacker-controlled content (CVSS UI:R), such as visiting a malicious page while their Tuleap session is active. The attacker itself needs no account or privileges (PR:N), but cannot act without this authenticated, interacting victim, which is the primary limiting factor. The affected feature is specifically the tracker general-settings configuration in Tuleap Community Edition below 17.0.99.1762444754 and Enterprise Edition prior to 17.0-2, 16.13-7, and 16.12-10; instances already upgraded to the fixed versions are not exploitable. No special non-default configuration is named as a prerequisite, but the impact is confined to integrity of tracker settings with no confidentiality or availability effect.

This is a low-to-moderate priority issue, and the signals are internally consistent rather than conflicting. The CVSS 3.1 base score of 4.3 (MEDIUM) reflects a cross-site request forgery (CWE-352) flaw with network vector (AV:N), low complexity (AC:L), no attacker privileges (PR:N), but mandatory user interaction (UI:R), unchanged scope (S:U), and only a low integrity impact (I:N→ actually C:N/I:L/A:N - no confidentiality or availability impact). The EPSS score is very low at 0.02% (5th percentile), indicating virtually no observed exploitation activity in the wild. There is no CISA KEV listing and no public exploit code identified in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' All signals align toward LOW real-world urgency: the impact is limited to unauthorized changes to tracker general settings (an integrity-only, non-privilege-escalating effect), exploitation requires tricking an authenticated victim with sufficient tracker-administration rights into interacting with attacker-controlled content, and the EPSS probability confirms this is not a mass-exploitation target. A patch is confirmed available from the vendor. This is a legitimate defense-in-depth fix rather than an emergency; prioritize routine patching over out-of-band response.

An attacker crafts a malicious web page or email containing a forged request targeting a Tuleap tracker's general-settings endpoint and lures a logged-in Tuleap user who has rights to modify that tracker into visiting it. Because the application does not adequately validate request origin (CWE-352), the victim's authenticated browser silently submits the state-changing request, altering the tracker's general settings without the victim's intent. No public exploit code is identified at time of analysis, and the network vector with low complexity is offset by the requirement that the victim be authenticated and actively interact (UI:R).