CVE-2025-53902

Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition prior to version 16.9.99.1752585665 and Tuleap Enterprise Edition prior to 16.8-6 and 16.9-5, users may potentially access confidential information from artifacts that they are not authorized to view. This is fixed in Tuleap Community Edition prior to version 16.9.99.1752585665 and Tuleap Enterprise Edition prior to 16.8-6 and 16.9-5.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/Enalean/tuleap/commit/ebe054df8a2672afee41af84e5ba14b57ef8b789
https://github.com/Enalean/tuleap/security/advisories/GHSA-6f24-5v47-rj6j
https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=ebe054df8a2672afee41af84e5ba14b57ef8b789
https://tuleap.net/plugins/tracker/?aid=43704

Configurations

No configuration.

History

31 Jul 2025, 18:42

Type	Values Removed	Values Added
Summary		(es) Tuleap es una suite de código abierto creada para facilitar la gestión del desarrollo de software y la colaboración. En Tuleap Community Edition anterior a la versión 16.9.99.1752585665 y Tuleap Enterprise Edition anterior a la 16.8-6 y 16.9-5, los usuarios podrían acceder a información confidencial de artefactos a los que no están autorizados a acceder. Esto se ha corregido en Tuleap Community Edition anterior a la versión 16.9.99.1752585665 y Tuleap Enterprise Edition anterior a la 16.8-6 y 16.9-5.

29 Jul 2025, 20:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-07-29 20:15

Updated : 2025-07-31 18:42

NVD link : CVE-2025-53902

Mitre link : CVE-2025-53902

CVE.ORG link : CVE-2025-53902

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2025-53902", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2025-07-29T20:15:28.673", "references": [{"url": "https://github.com/Enalean/tuleap/commit/ebe054df8a2672afee41af84e5ba14b57ef8b789", "source": "security-advisories@github.com"}, {"url": "https://github.com/Enalean/tuleap/security/advisories/GHSA-6f24-5v47-rj6j", "source": "security-advisories@github.com"}, {"url": "https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=ebe054df8a2672afee41af84e5ba14b57ef8b789", "source": "security-advisories@github.com"}, {"url": "https://tuleap.net/plugins/tracker/?aid=43704", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition prior to version 16.9.99.1752585665 and Tuleap Enterprise Edition prior to 16.8-6 and 16.9-5, users may potentially access confidential information from artifacts that they are not authorized to view. This is fixed in Tuleap Community Edition prior to version 16.9.99.1752585665 and Tuleap Enterprise Edition prior to 16.8-6 and 16.9-5."}, {"lang": "es", "value": "Tuleap es una suite de c\u00f3digo abierto creada para facilitar la gesti\u00f3n del desarrollo de software y la colaboraci\u00f3n. En Tuleap Community Edition anterior a la versi\u00f3n 16.9.99.1752585665 y Tuleap Enterprise Edition anterior a la 16.8-6 y 16.9-5, los usuarios podr\u00edan acceder a informaci\u00f3n confidencial de artefactos a los que no est\u00e1n autorizados a acceder. Esto se ha corregido en Tuleap Community Edition anterior a la versi\u00f3n 16.9.99.1752585665 y Tuleap Enterprise Edition anterior a la 16.8-6 y 16.9-5."}], "lastModified": "2025-07-31T18:42:56.503", "sourceIdentifier": "security-advisories@github.com"}