CVE-2025-27402: Tuleap is missing CSRF protections on tracker fields administrative operations
Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap is missing CSRF protections on tracker fields administrative operations. An attacker could use this vulnerability to trick victims into removing or updating tracker fields. This vulnerability is fixed in Tuleap Community Edition 16.4.99.1740414959 and Tuleap Enterprise Edition 16.4-6 and 16.3-11.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tuleap Community Editionto a version that resolves this vulnerability.Fixed in 16.4.99.1740414959 - Upgrade
Upgrade
Tuleap Enterprise Editionto a version that resolves this vulnerability.Fixed in 16.4-6 - Upgrade
Upgrade
Tuleap Enterprise Editionto a version that resolves this vulnerability.Fixed in 16.3-11
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27402?
CVE-2025-27402 is rated as a medium severity vulnerability due to its potential to allow CSRF attacks on tracker fields administration.
How do I fix CVE-2025-27402?
To fix CVE-2025-27402, ensure your Tuleap installation is updated to the latest version that includes CSRF protection for tracker fields.
What versions of Tuleap are affected by CVE-2025-27402?
CVE-2025-27402 affects Tuleap Community Edition versions up to 16.4.99.1740414959 and Tuleap Enterprise Edition versions between 16.3 and 16.4-6.
What type of attack can exploit CVE-2025-27402?
CVE-2025-27402 can be exploited using Cross-Site Request Forgery (CSRF) attacks to manipulate tracker fields without user consent.
Is there any workaround for CVE-2025-27402 until a patch is applied?
Currently, the best workaround for CVE-2025-27402 is to limit access to the Tuleap administrative functions until the vulnerability is patched.