Tuleap hat fehlende CSRF-Schutzmaßnahmen in seinen Tracker-Feld-Abhängigkeiten

Successful exploitation of CVE-2025-65962 allows an attacker to forge requests on behalf of an authenticated user, enabling them to modify tracker fields within the Tuleap system. This could involve altering task assignments, changing issue priorities, or manipulating other critical data elements. The impact is directly proportional to the privileges of the user whose session is hijacked. An attacker could potentially gain unauthorized access to sensitive information or disrupt workflows by maliciously altering data. While the vulnerability is classified as CSRF, the potential for data manipulation within a collaborative development environment makes it a significant concern.

Organizations utilizing Tuleap Enterprise Edition in collaborative software development environments are at risk. Specifically, deployments with shared user accounts or those lacking robust access controls are more vulnerable. Legacy Tuleap installations running versions prior to 16.13-9 are particularly exposed.

• php: Examine Tuleap application logs for suspicious requests originating from unexpected origins. Look for POST requests to tracker field update endpoints with unusual referer headers.

grep -i 'referer: .*tuleap.*' /var/log/apache2/access.log

• generic web: Check for unusual tracker field modifications in Tuleap. Monitor user activity for unexpected changes to task assignments or issue priorities. • generic web: Review Tuleap's Content Security Policy (CSP) configuration. Ensure it restricts resource loading to trusted origins to mitigate CSRF attacks.

1. 2025-12-08Disclosure

   disclosure

1. Reserviert2025-11-18
2. Veröffentlicht2025-12-08
3. Geändert2025-12-09
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-65962 is to upgrade Tuleap to a patched version. Upgrade to either Tuleap Community Edition version 17.0.99.1763803709 or Tuleap Enterprise Edition versions 17.0-4 or 16.13-9. If an immediate upgrade is not feasible, consider implementing temporary workarounds such as enforcing strict content security policies (CSP) to restrict the origins from which Tuleap can load resources. Additionally, review and strengthen user authentication practices, including multi-factor authentication (MFA), to reduce the risk of session hijacking. After upgrade, confirm the fix by attempting a CSRF attack on a tracker field and verifying that the request is rejected.