CVE-2025-27150

Katalog CVE

CVSS 6.5 · Medium EPSS 0,38%

Kerentanan Insertion of Sensitive Information into Externally-Accessible File or Directory pada enalean tuleap. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Tuleap is an Open Source Suite to improve management of software developments and collaboration. The password to connect the Redis instance is not purged from the archive generated with tuleap collect-system-data. These archives are likely to be used by support teams that should not have access to this password. The vulnerability is fixed in Tuleap Community Edition 16.4.99.1740492866 and Tuleap Enterprise Edition 16.4-6 and 16.3-11.

Rincian

Terbit di NVD

4 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory

EPSS (30 hari)

0,38% peluang dieksploitasi; lebih tinggi dari 29,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://tuleap.net/plugins/tracker/?aid=41870 issue tracking · patch · advisory vendor
• https://github.com/Enalean/tuleap/commit/a6702622a8db969a17522b8fac0774afdb1c916f patch
• https://github.com/Enalean/tuleap/security/advisories/GHSA-jc5r-684x-j46q patch · advisory pihak ketiga