CVE-2018-7634: Enalean Tuleap

High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days.

An issue was discovered in Enalean Tuleap 9.17. Lack of CSRF attack mitigation while changing an e-mail address makes it possible to abuse the functionality by attackers. By making a CSRF attack, an attacker could make a victim change his registered e-mail address on the application, leading to account takeover.

Affected products

• Enalean Tuleap: version 9.17 only

Published 2018-03-01. Last modified 2026-06-17.