Tuleap Missing Cross-Site Request Forgery Protections Allow Tracker Trigger Manipulation

A vulnerability exists in Tuleap Community Edition versions prior to 17.0.99.1763126988 and Tuleap Enterprise Edition versions prior to 17.0-3 and 16.13-8. These versions lack adequate Cross-Site Request Forgery (CSRF) protections in the management of tracker triggers, enabling attackers to exploit this weakness by creating or removing tracker triggers on behalf of victims.

Impact

Exploitation of this vulnerability could lead to unauthorized creation or deletion of tracker triggers, potentially disrupting workflow management.

Reproduction

To reproduce this vulnerability, a user must be on an affected version of Tuleap. Once confirmed, an attacker can craft a request that exploits the missing CSRF protection, tricking the user into unintentionally adding or removing a tracker trigger.

Remediation

Users can upgrade to Tuleap Community Edition 17.0.99.1763126988 or Tuleap Enterprise Edition 17.0-3 or 16.13-8 to address this vulnerability.