Cyber Resilience

CVE-2025-27150

Medium

Published: 04 March 2025

Published
04 March 2025
Modified
22 August 2025
KEV Added
—
Patch
—
CVSS Score v3.1 5.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS Score 0.0043 63.3th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-27150 is a medium-severity Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) vulnerability in Enalean Tuleap. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Credentials In Files (T1552.001); ranked in the top 36.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Tuleap is an Open Source Suite to improve management of software developments and collaboration. The password to connect the Redis instance is not purged from the archive generated with tuleap collect-system-data. These archives are likely to be used by support…

more

teams that should not have access to this password. The vulnerability is fixed in Tuleap Community Edition 16.4.99.1740492866 and Tuleap Enterprise Edition 16.4-6 and 16.3-11.

CWE(s)
CWE-538

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1552.001 Credentials In Files Credential Access
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
attack.mitre.org →
Why these techniques?

The vulnerability exposes the Redis password in generated troubleshooting archives (externally accessible files), enabling adversaries to retrieve unsecured credentials from files.

Affected Assets

enalean
tuleap
≤ 16.3-11 · ≤ 16.4.99.1740492866 · 16.4 — 16.4-6

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AC-22 Publicly Accessible Content
addresses: CWE-538

Pre- and post-publication reviews prevent insertion of sensitive information into externally-accessible public locations.

AU-13 Monitoring for Information Disclosure
addresses: CWE-538

Monitors for sensitive information placed in externally accessible files or directories.

CM-13 Data Action Mapping
addresses: CWE-538

The map shows if data actions result in sensitive information being placed in externally accessible locations.

IR-9 Information Spillage Response
addresses: CWE-538

Isolation and eradication reduce the ability to exploit sensitive information inserted into externally-accessible files or directories.

RA-2 Security Categorization
addresses: CWE-538

Approved categorization forces identification of externally accessible files that contain sensitive content so they receive proper protection.

RA-8 Privacy Impact Assessments
addresses: CWE-538

The pre-implementation review identifies externally accessible files or directories containing PII and drives access restrictions or removal.

SI-20 Tainting
addresses: CWE-538

Tainting makes it possible to determine when sensitive data has been removed from externally accessible files or directories.

SR-7 Supply Chain Operations Security
addresses: CWE-538

OPSEC practices stop placement of supply-chain information into locations accessible to external parties.

References