CVE-2025-24029

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Users (possibly anonymous ones if the widget is used in the dashboard of a public project) might get access to artifacts they should not see. This issue has been addressed in Tuleap Community Edition 16.3.99.1737562605 as well as Tuleap Enterprise Edition 16.3-5 and Tuleap Enterprise Edition 16.2-7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-280

Affected software

No affected versions have been published.

Timeline

Published: Feb 3, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-24037.5A denial-of-service vulnerability due to improper prioritization of network traffic over protection mechanism exists in Relion 670/650 and S CVE-2025-240307.1Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. A user with access CVE-2025-240315.1PAM-PKCS#11 is a Linux-PAM login module that allows a X.509 certificate based user login. In versions 0.6.12 and prior, the pam_pkcs11 modul CVE-2025-240329.2PAM-PKCS#11 is a Linux-PAM login module that allows a X.509 certificate based user login. Prior to version 0.6.13, if cert_policy is set to CVE-2025-240337.5@fastify/multipart is a Fastify plugin for parsing the multipart content-type. Prior to versions 8.3.1 and 9.0.3, the `saveRequestFiles` fun CVE-2025-240343.2Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Starting in version 0.7.0 and prior to versions 0.7.15 and CVE-2025-240358.1Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a CVE-2025-240367.0Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability CVE-2025-240397.3Visual Studio Code Elevation of Privilege Vulnerability CVE-2025-24044.3Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ubit Information Technologies S CVE-2025-240427.3Visual Studio Code JS Debug Extension Elevation of Privilege Vulnerability CVE-2025-240437.5Improper verification of cryptographic signature in .NET allows an authorized attacker to execute code over a network.