CVE-2025-64760
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-12-08

Last updated on: 2025-12-10

Assigner: GitHub, Inc.

Description
Tuleap is a free and open source suite for management of software development and collaboration. Versions of Tuleap Community Edition prior to 17.0.99.1763126988 and Tuleap Enterprise Edition prior to 17.0-3 and 16.13-8 have missing CSRF protections which allow attackers to create or remove tracker triggers. This issue is fixed in Tuleap Community Edition version 17.0.99.1763126988 and Tuleap Enterprise Edition versions 17.0-3 and 16.13-8.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-08
Last Modified
2025-12-10
Generated
2026-06-16
AI Q&A
2025-12-09
EPSS Evaluated
2026-06-15
NVD
CVE-2025-64760
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
tuleap tuleap_enterprise_edition *
tuleap tuleap_community_edition *
enalean tuleap to 17.0.99.1763126988 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in Tuleap Community and Enterprise Editions involves missing CSRF (Cross-Site Request Forgery) protections. Because of this, attackers can exploit the lack of protection to create or remove tracker triggers without proper authorization.

Impact Analysis

The vulnerability allows attackers to manipulate tracker triggers in Tuleap, potentially disrupting software development and collaboration workflows. This could lead to unauthorized changes that affect the integrity and reliability of project tracking data.

Mitigation Strategies

To mitigate this vulnerability, upgrade Tuleap Community Edition to version 17.0.99.1763126988 or later, or Tuleap Enterprise Edition to versions 17.0-3 or 16.13-8 or later, as these versions include the fix for the missing CSRF protections.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-64760. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart