Tuleap Missing CSRF Protection in Tracker Hierarchy Administration Vulnerability

A vulnerability exists in Tuleap's tracker hierarchy administration due to the absence of Cross-Site Request Forgery (CSRF) protection. This flaw allows attackers to deceive users into modifying or adding artifacts and comments. The issue is present in Tuleap Community Edition versions prior to 16.5.99.1742306712 and Tuleap Enterprise Edition versions prior to 16.5-5 and 16.4-8.

Impact

Exploitation of this vulnerability could lead to unauthorized changes in the hierarchy of trackers, allowing for the manipulation of tracker relationships and dependencies.

Reproduction

To reproduce this vulnerability, access the tracker hierarchy administration without CSRF protection. This can be done by navigating to the 'admin-hierarchy' function of a tracker, where the vulnerability can be exploited by submitting a hierarchy update without the necessary CSRF token.

Remediation

Users can upgrade to Tuleap Community Edition 16.5.99.1742306712 or Tuleap Enterprise Edition 16.5-5 or 16.4-8 to address this vulnerability.