CVE-2025-27401

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-27401", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-02-24T15:51:17.267Z", "datePublished": "2025-03-04T16:58:18.478Z", "dateUpdated": "2025-03-04T17:20:34.993Z"}, "containers": {"cna": {"title": "In Tuleap, deleting a report can delete criteria filters in other reports", "problemTypes": [{"descriptions": [{"cweId": "CWE-440", "lang": "en", "description": "CWE-440: Expected Behavior Violation", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/Enalean/tuleap/security/advisories/GHSA-3rjf-87rf-h8m9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Enalean/tuleap/security/advisories/GHSA-3rjf-87rf-h8m9"}, {"name": "https://github.com/Enalean/tuleap/commit/0070fef5c3b27fd402d3232041c6e03f79a84ffd", "tags": ["x_refsource_MISC"], "url": "https://github.com/Enalean/tuleap/commit/0070fef5c3b27fd402d3232041c6e03f79a84ffd"}, {"name": "https://tuleap.net/plugins/tracker/?aid=41850", "tags": ["x_refsource_MISC"], "url": "https://tuleap.net/plugins/tracker/?aid=41850"}], "affected": [{"vendor": "Enalean", "product": "tuleap", "versions": [{"version": "< 16.4.99.1740498975", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-03-04T16:58:18.478Z"}, "descriptions": [{"lang": "en", "value": "Tuleap is an Open Source Suite to improve management of software developments and collaboration. In a standard usages of Tuleap, the issue has a limited impact, it will mostly leave dangling data. However, a malicious user could create and delete reports multiple times to cycle through all the filters of all reports of the instance and delete them. The malicious user only needs to have access to one tracker. This would result in the loss of all criteria filters forcing users and tracker admins to re-create them. This vulnerability is fixed in Tuleap Community Edition 16.4.99.1740498975 and Tuleap Enterprise Edition 16.4-6 and 16.3-11."}], "source": {"advisory": "GHSA-3rjf-87rf-h8m9", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-04T17:20:27.746696Z", "id": "CVE-2025-27401", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-04T17:20:34.993Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-27401", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-04T17:20:27.746696Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-04T17:20:31.347Z"}}], "cna": {"title": "In Tuleap, deleting a report can delete criteria filters in other reports", "source": {"advisory": "GHSA-3rjf-87rf-h8m9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "Enalean", "product": "tuleap", "versions": [{"status": "affected", "version": "< 16.4.99.1740498975"}]}], "references": [{"url": "https://github.com/Enalean/tuleap/security/advisories/GHSA-3rjf-87rf-h8m9", "name": "https://github.com/Enalean/tuleap/security/advisories/GHSA-3rjf-87rf-h8m9", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Enalean/tuleap/commit/0070fef5c3b27fd402d3232041c6e03f79a84ffd", "name": "https://github.com/Enalean/tuleap/commit/0070fef5c3b27fd402d3232041c6e03f79a84ffd", "tags": ["x_refsource_MISC"]}, {"url": "https://tuleap.net/plugins/tracker/?aid=41850", "name": "https://tuleap.net/plugins/tracker/?aid=41850", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Tuleap is an Open Source Suite to improve management of software developments and collaboration. In a standard usages of Tuleap, the issue has a limited impact, it will mostly leave dangling data. However, a malicious user could create and delete reports multiple times to cycle through all the filters of all reports of the instance and delete them. The malicious user only needs to have access to one tracker. This would result in the loss of all criteria filters forcing users and tracker admins to re-create them. This vulnerability is fixed in Tuleap Community Edition 16.4.99.1740498975 and Tuleap Enterprise Edition 16.4-6 and 16.3-11."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-440", "description": "CWE-440: Expected Behavior Violation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-03-04T16:58:18.478Z"}}}, "cveMetadata": {"cveId": "CVE-2025-27401", "state": "PUBLISHED", "dateUpdated": "2025-03-04T17:20:34.993Z", "dateReserved": "2025-02-24T15:51:17.267Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-03-04T16:58:18.478Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "tuleap", "vendor": "Enalean", "versions": [{"status": "affected", "version": "< 16.4.99.1740498975"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "44FFF09C-980B-4D7E-AF34-BBAECB1B179D", "versionEndExcluding": "16.3-11", "vulnerable": true}, {"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:community:*:*:*", "matchCriteriaId": "5609916B-3E6B-4009-8837-701EF159FF6F", "versionEndExcluding": "16.4.99.1740498975", "vulnerable": true}, {"criteria": "cpe:2.3:a:enalean:tuleap:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "54A72640-277F-4E54-A2F4-8948FF0F16E2", "versionEndExcluding": "16.4-6", "versionStartIncluding": "16.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Tuleap is an Open Source Suite to improve management of software developments and collaboration. In a standard usages of Tuleap, the issue has a limited impact, it will mostly leave dangling data. However, a malicious user could create and delete reports multiple times to cycle through all the filters of all reports of the instance and delete them. The malicious user only needs to have access to one tracker. This would result in the loss of all criteria filters forcing users and tracker admins to re-create them. This vulnerability is fixed in Tuleap Community Edition 16.4.99.1740498975 and Tuleap Enterprise Edition 16.4-6 and 16.3-11."}, {"lang": "es", "value": "Tuleap es una suite de c\u00f3digo abierto para mejorar la gesti\u00f3n de los desarrollos de software y la colaboraci\u00f3n. En un uso est\u00e1ndar de Tuleap, el problema tiene un impacto limitado, en su mayor\u00eda dejar\u00e1 datos pendientes. Sin embargo, un usuario malintencionado podr\u00eda crear y eliminar informes varias veces para recorrer todos los filtros de todos los informes de la instancia y eliminarlos. El usuario malintencionado solo necesita tener acceso a un rastreador. Esto provocar\u00eda la p\u00e9rdida de todos los filtros de criterios, lo que obligar\u00eda a los usuarios y administradores de rastreadores a volver a crearlos. Esta vulnerabilidad se solucion\u00f3 en Tuleap Community Edition 16.4.99.1740498975 y Tuleap Enterprise Edition 16.4-6 y 16.3-11."}], "id": "CVE-2025-27401", "lastModified": "2026-06-17T09:03:31.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-27401", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-03-04T17:20:27.746696Z", "version": "2.0.3"}}]}, "published": "2025-03-04T17:15:19.547", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/Enalean/tuleap/commit/0070fef5c3b27fd402d3232041c6e03f79a84ffd"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/Enalean/tuleap/security/advisories/GHSA-3rjf-87rf-h8m9"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Issue Tracking", "Patch", "Vendor Advisory"], "url": "https://tuleap.net/plugins/tracker/?aid=41850"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-440"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-07-12T15:26:10.445705+00:00", "updated": "2025-07-12T15:26:10.445777+00:00", "vendors": ["enalean", "enalean$PRODUCT$tuleap"]}