Tuleap hat eine Cross-Site Request Forgery (CSRF) Schwachstelle

Successful exploitation of this CSRF vulnerability allows an attacker to manipulate Tuleap's tracker settings without the victim's knowledge or consent. This could lead to unauthorized modifications of tracking configurations, potentially impacting data integrity and operational workflows. An attacker could craft malicious links or embed requests within trusted websites to trigger these changes. The blast radius is limited to users with access to modify tracker settings within Tuleap, but the impact on those users can be significant, potentially disrupting tracking processes and introducing errors.

Organizations utilizing Tuleap Enterprise Edition for software development and collaboration are at risk. Specifically, teams responsible for managing and configuring Tuleap trackers, and users with permissions to modify tracker settings, are particularly vulnerable. Shared hosting environments where multiple users share a Tuleap instance may also amplify the risk.

• php: Examine Tuleap application logs for unusual POST requests originating from external domains. Look for patterns indicative of CSRF attacks, such as requests with unexpected parameters or actions. • generic web: Monitor access logs for requests to Tuleap endpoints that modify tracker settings, especially those originating from unfamiliar IP addresses. • generic web: Use a web application firewall (WAF) to detect and block CSRF attacks by inspecting HTTP headers and request parameters for suspicious patterns.

1. 2025-12-08Disclosure

   disclosure

1. Reserviert2025-11-05
2. Veröffentlicht2025-12-08
3. Geändert2025-12-09
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-64498 is to upgrade Tuleap Enterprise Edition to version 17.0-2, 16.13-7, or 16.12-10. If an immediate upgrade is not feasible, consider implementing stricter input validation and output encoding on all user-supplied data within Tuleap. Additionally, implement CSRF protection mechanisms, such as synchronizer tokens or double-submit cookies, to prevent unauthorized requests. Review and restrict access permissions to tracker settings to limit the potential impact of a successful attack. After upgrading, confirm the fix by attempting to trigger a tracker setting modification via a crafted CSRF request – it should be rejected.