CVE-2025-0504

Katalog CVE

CVSS 5.4 · Medium EPSS 0,16%

Kerentanan Incorrect Privilege Assignment. Skor CVSS 3.1 5.4 (Medium) menurut synopsys.com.

Deskripsi (NVD)

Black Duck SCA versions prior to 2025.10.0 had user role permissions configured in an overly broad manner. Users with the scoped Project Manager user role with the Global User Read access permission enabled access to certain Project Administrator functionalities which should have be inaccessible. Exploitation does not grant full system control, but it may enable unauthorized changes to project configurations or access to system sensitive information.

Rincian

Terbit di NVD

21 November 2025

Terakhir diubah

8 Oktober 2026

Status NVD

Deferred

CVSS 3.1

5.4 (Medium), sumber synopsys.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-266: Incorrect Privilege Assignment

EPSS (30 hari)

0,16% peluang dieksploitasi; lebih tinggi dari 5,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://community.blackduck.com/s/article/Black-Duck-Product-Security-Advisory-CVE-2025-0504