← Back

CVE-2025-64497

nvd nist
Published: Dec 8, 2025Modified: Dec 10, 2025

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Exploitability: 2.8 / Impact: 3.6
Source: NVD

Description

Tuleap is an Open Source Suite for management of software development and collaboration. Versions below 17.0.99.1762431347 of Tuleap Community Edition and Tuleap Enterprise Edition below 17.0-2, 16.13-7 and 16.12-10 allow attackers to access file release system information in projects they do not have access to. This issue is fixed in version 17.0.99.1762431347 of the Tuleap Community Edition and versions 17.0-2, 16.13-7 and 16.12-10 of Tuleap Enterprise Edition.

Affected (4)

Products: Enalean: Tuleap
Enalean
1 product
Tuleap
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Enalean
Tuleap
Before 17.0.99.1762431347
Tuleap
Before 16.12-10
Tuleap
From 16.13 to 16.13-7
Tuleap
From 17.0 to 17.0-2

Related CWEs

CWE-639
Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (4)

Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
Vendor Advisory
Source: security-advisories@github.com
PatchBroken Link
Source: security-advisories@github.com
Issue TrackingVendor Advisory

Timeline

No history available yet.