CVE-2025-64499: Tuleap is missing CSRF protections for its planning management API
Tuleap is a free and open source suite for management of software development and collaboration. Tuleap Community Editon versions prior to 17.0.99.1762456922 and Tuleap Enterprise Edition versions prior to 17.0-2, 16.13-7 and 16.12-10 are vulnerable to CSRF attacks through planning management API. Attackers have access to create, edit or remove plans. This issue is fixed in Tuleap Community Edition version 17.0.99.1762456922 and Tuleap Enterprise Edtion versions 17.0-2, 16.13-7 and 16.12-10.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64499?
The severity of CVE-2025-64499 is classified as critical due to its potential for CSRF attacks.
How do I fix CVE-2025-64499?
To fix CVE-2025-64499, upgrade to Tuleap Community Edition version 17.0.99.1762456922 or Tuleap Enterprise Edition versions 17.0-2, 16.13-7, or 16.12-10.
What types of attacks does CVE-2025-64499 allow?
CVE-2025-64499 allows attackers to perform Cross-Site Request Forgery (CSRF) attacks.
Which versions of Tuleap are affected by CVE-2025-64499?
Tuleap Community Edition versions before 17.0.99.1762456922 and Tuleap Enterprise Edition versions before 17.0-2, 16.13-7, and 16.12-10 are affected by CVE-2025-64499.
Is CVE-2025-64499 present in Tuleap's latest release?
No, CVE-2025-64499 is not present in the latest Tuleap releases that have received the necessary updates.