CVE-2025-0504

Black Duck SCA versions prior to 2025.10.0 had user role permissions configured in an overly broad manner. Users with the scoped Project Manager user role with the Global User Read access permission enabled access to certain Project Administrator functionalities which should have be inaccessible. Exploitation does not grant full system control, but it may enable unauthorized changes to project configurations or access to system sensitive information.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://community.blackduck.com/s/article/Black-Duck-Product-Security-Advisory-CVE-2025-0504

Configurations

No configuration.

History

08 Oct 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de Black Duck SCA anteriores a 2025.10.0 tenían los permisos de rol de usuario configurados de forma demasiado amplia. Los usuarios con el rol de usuario de Project Manager con ámbito y con el permiso de acceso de Lectura de Usuario Global habilitado, accedían a ciertas funcionalidades de Administrador de Proyecto que deberían haber sido inaccesibles. La explotación no otorga control total del sistema, pero puede permitir cambios no autorizados en las configuraciones del proyecto o el acceso a información sensible del sistema.

Information

Published : 2025-11-21 22:16

Updated : 2026-10-08 10:10

NVD link : CVE-2025-0504

Mitre link : CVE-2025-0504

CVE.ORG link : CVE-2025-0504

JSON object : View

Products Affected

No product.

CWE

CWE-266

Incorrect Privilege Assignment

{"id": "CVE-2025-0504", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-0504", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-21T21:56:58.914135Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@synopsys.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@synopsys.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@synopsys.com", "affectedData": [{"vendor": "Black Duck", "product": "Black Duck SCA", "versions": [{"status": "affected", "version": "0", "lessThan": "2025.10.0", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-21T22:16:17.790", "references": [{"url": "https://community.blackduck.com/s/article/Black-Duck-Product-Security-Advisory-CVE-2025-0504", "source": "disclosure@synopsys.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@synopsys.com", "description": [{"lang": "en", "value": "CWE-266"}]}], "descriptions": [{"lang": "en", "value": "Black Duck SCA versions prior to 2025.10.0 had user role permissions configured in an overly broad manner. Users with the scoped Project Manager user role with the Global User Read access permission enabled access to certain Project Administrator functionalities which should have be inaccessible. Exploitation does not grant full system control, but it may enable unauthorized changes to project configurations or access to system sensitive information."}, {"lang": "es", "value": "Las versiones de Black Duck SCA anteriores a 2025.10.0 ten\u00edan los permisos de rol de usuario configurados de forma demasiado amplia. Los usuarios con el rol de usuario de Project Manager con \u00e1mbito y con el permiso de acceso de Lectura de Usuario Global habilitado, acced\u00edan a ciertas funcionalidades de Administrador de Proyecto que deber\u00edan haber sido inaccesibles. La explotaci\u00f3n no otorga control total del sistema, pero puede permitir cambios no autorizados en las configuraciones del proyecto o el acceso a informaci\u00f3n sensible del sistema."}], "lastModified": "2026-10-08T10:10:00.227", "sourceIdentifier": "disclosure@synopsys.com"}