FKIE_CVE-2025-53902

Vulnerability from fkie_nvd - Published: 2025-07-29 20:15 - Updated: 2025-08-22 15:30
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Summary
Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition prior to version 16.9.99.1752585665 and Tuleap Enterprise Edition prior to 16.8-6 and 16.9-5, users may potentially access confidential information from artifacts that they are not authorized to view. This is fixed in Tuleap Community Edition prior to version 16.9.99.1752585665 and Tuleap Enterprise Edition prior to 16.8-6 and 16.9-5.
References
security-advisories@github.comhttps://github.com/Enalean/tuleap/commit/ebe054df8a2672afee41af84e5ba14b57ef8b789Patch
security-advisories@github.comhttps://github.com/Enalean/tuleap/security/advisories/GHSA-6f24-5v47-rj6jThird Party Advisory
security-advisories@github.comhttps://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=ebe054df8a2672afee41af84e5ba14b57ef8b789Permissions Required
security-advisories@github.comhttps://tuleap.net/plugins/tracker/?aid=43704Exploit, Vendor Advisory
Impacted products
Vendor Product Version
enalean tuleap *
enalean tuleap *
enalean tuleap *
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "DEC35025-2E64-412A-A4CF-64F2D4FB51CD",
              "versionEndExcluding": "16.8-6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:*",
              "matchCriteriaId": "5B652FD8-9D66-402B-9EC0-4A3509B44322",
              "versionEndExcluding": "16.9.99.1752585665",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "ED55BA98-E49B-4E6F-AF9F-2AC22C60D0BD",
              "versionEndExcluding": "16.9-5",
              "versionStartIncluding": "16.9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition prior to version 16.9.99.1752585665 and Tuleap Enterprise Edition prior to 16.8-6 and 16.9-5, users may potentially access confidential information from artifacts that they are not authorized to view. This is fixed in Tuleap Community Edition prior to version 16.9.99.1752585665 and Tuleap Enterprise Edition prior to 16.8-6 and 16.9-5."
    },
    {
      "lang": "es",
      "value": "Tuleap es una suite de c\u00f3digo abierto creada para facilitar la gesti\u00f3n del desarrollo de software y la colaboraci\u00f3n. En Tuleap Community Edition anterior a la versi\u00f3n 16.9.99.1752585665 y Tuleap Enterprise Edition anterior a la 16.8-6 y 16.9-5, los usuarios podr\u00edan acceder a informaci\u00f3n confidencial de artefactos a los que no est\u00e1n autorizados a acceder. Esto se ha corregido en Tuleap Community Edition anterior a la versi\u00f3n 16.9.99.1752585665 y Tuleap Enterprise Edition anterior a la 16.8-6 y 16.9-5."
    }
  ],
  "id": "CVE-2025-53902",
  "lastModified": "2025-08-22T15:30:09.243",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-07-29T20:15:28.673",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/Enalean/tuleap/commit/ebe054df8a2672afee41af84e5ba14b57ef8b789"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/Enalean/tuleap/security/advisories/GHSA-6f24-5v47-rj6j"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Permissions Required"
      ],
      "url": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit\u0026h=ebe054df8a2672afee41af84e5ba14b57ef8b789"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://tuleap.net/plugins/tracker/?aid=43704"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.