Cyber Resilience

CVE-2025-27094

Enalean Tuleap ≤ 16.3-9

Published
03 March 2025
Modified
10 July 2025
Patch / advisory
CVSS Score v3.1 5.4
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
EPSS Score 0.0035 28th percentile
Risk Priority 43 floored blend · peak EPSS

Summary

CVE-2025-27094 is a medium-severity Expected Behavior Violation (CWE-440) vulnerability in Enalean Tuleap. Its CVSS base score is 5.4 (Medium).

Operationally, ranked at the 28th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-6 (Security and Privacy Function Verification) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Tuleap is an open-source suite designed to improve software development management and collaboration. A malicious user with access to a tracker could force-reset certain field configurations, leading to potential information loss. The display time attribute for the date field, the…

more

size attribute for the multiselectbox field, the default value, number of rows, and columns attributes for the text field, and the default value, size, and max characters attributes for the string field configurations are lost when added as criteria in a saved report. Additionally, in Tuleap Community Edition versions 16.4.99.1739806825 to 16.4.99.1739877910, this issue could be exploited to prevent access to tracker data by triggering a crash. This vulnerability has been fixed in Tuleap Community Edition 16.4.99.1739877910 and Tuleap Enterprise Edition 16.3-9 and 16.4-4.

CWE(s)

Related Threats

CVEs Like This One

CVE-2025-27401Same product: Enalean Tuleap
CVE-2024-30246Same product: Enalean Tuleap
CVE-2017-7411Same product: Enalean Tuleap
CVE-2024-37167Same product: Enalean Tuleap
CVE-2024-52599Same product: Enalean Tuleap
CVE-2025-30209Same product: Enalean Tuleap
CVE-2025-50179Same product: Enalean Tuleap
CVE-2025-22129Same product: Enalean Tuleap
CVE-2025-24029Same product: Enalean Tuleap
CVE-2025-29766Same product: Enalean Tuleap

Affected Assets

enalean
tuleap
≤ 16.3-9 · ≤ 16.4.99.1739877910 · 16.4 — 16.4-4

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

Developer testing and evaluation directly checks whether implemented functions match their specifications.

Security function verification confirms that functions operate according to their defined expected behavior.

Requiring a documented security architecture and design reduces the chance that implementation deviates from intended behavior.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 full match
prevents

Secure SDLC practices directly enforce specification compliance and catch expected-behavior violations during development.

ID.IM-02 partial match
prevents

Security testing and exercises help discover behavior deviations before deployment.

ID.RA-01 partial match
prevents

Vulnerability identification can surface spec-violating flaws, while eliminating the weakness reduces some vulnerability backlog.

PR.PS-02 partial match
prevents

Routine software maintenance and patching can remediate discovered specification violations.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing in development and acceptance validates that functions behave as specified.

prevents

Secure development life cycle mandates verification against specifications, directly reducing expected-behavior violations.

prevents

Application security requirements explicitly define expected behavior that must be met.

prevents

Secure coding practices enforce adherence to functional specifications during implementation.

finds

Change management can catch specification deviations introduced by modifications.

none

Documented operating procedures reduce the chance that functions deviate from intended behavior.

References