Description
Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap allows cross-site scripting (XSS) via the content of RSS feeds in the RSS widgets. A project administrator or someone with control over an used RSS feed could use this vulnerability to force victims to execute uncontrolled code. This vulnerability is fixed in Tuleap Community Edition 16.5.99.1742562878 and Tuleap Enterprise Edition 16.5-5 and 16.4-8.
References (4)
Core 4
Core References
Third Party Advisory x_refsource_confirm
https://github.com/Enalean/tuleap/security/advisories/GHSA-39gx-34fc-rx6r
Patch x_refsource_misc
https://github.com/Enalean/tuleap/commit/54cce3f5e883d16055cb0239e023f48cdf5eb25f
Broken Link x_refsource_misc
https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=54cce3f5e883d16055cb0239e023f48cdf5eb25f
Vendor Advisory x_refsource_misc
https://tuleap.net/plugins/tracker/?aid=42243
Scores
CVSS v3
4.8
EPSS
0.0021
EPSS Percentile
42.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
total
Details
CWE
CWE-79
CWE-84
Status
published
Products (2)
enalean/tuleap
< 16.4-8
enalean/tuleap
< 16.5.99.1742562878
Published
Mar 31, 2025
Tracked Since
Feb 18, 2026