← Back

CVE-2025-52899

nvd nist
Published: Jul 29, 2025Modified: Jun 17, 2026

JSON object

Loading...
5.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Exploitability: 3.9 / Impact: 1.4
Source: security-advisories@github.com (Secondary)

Description

Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition prior to version 16.9.99.1750843170 and Tuleap Enterprise Edition prior to 16.8-4 and 16.9-2, the forgot password form allows for user enumeration. This is fixed in Tuleap Community Edition version 16.9.99.1750843170 and Tuleap Enterprise Edition 16.8-4 and 16.9-2.

Affected (3)

Products: Enalean: Tuleap
Enalean
1 product
Tuleap
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Enalean
Tuleap
Before 16.9.99.1750843170
Tuleap
Before 16.8-4
Tuleap
From 16.9 to 16.9-2

Related CWEs

CWE-204
Observable Response Discrepancy
The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

References (4)

Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
Third Party Advisory
Source: security-advisories@github.com
Permissions Required
Source: security-advisories@github.com
Issue TrackingVendor Advisory

Timeline

No history available yet.