BaseFortify

Publication date: 2025-11-21

Last updated on: 2025-11-21

Assigner: Synopsys

Description

Black Duck SCA versions prior to 2025.10.0 had user role permissions configured in an overly broad manner. Users with the scoped Project Manager user role with the Global User Read access permission enabled access to certain Project Administrator functionalities which should have be inaccessible. Exploitation does not grant full system control, but it may enable unauthorized changes to project configurations or access to system sensitive information.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-21

Last Modified

2025-11-21

Generated

2026-07-06

AI Q&A

2025-11-22

EPSS Evaluated

2026-07-05

NVD

CVE-2025-0504

EUVD

EUVD-2025-198515

Affected Vendors & Products

Vendor	Product	Version / Range
synopsys	black_duck_sca	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-266	A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability in Black Duck SCA versions prior to 2025.10.0 involves overly broad user role permissions. Specifically, users assigned the scoped Project Manager role with Global User Read access can access certain Project Administrator functions that should be restricted. While exploitation does not allow full system control, it can enable unauthorized changes to project configurations or access to sensitive system information.

Impact Analysis

The vulnerability can impact you by allowing users with limited permissions to make unauthorized changes to project configurations or gain access to sensitive system information. Although it does not grant full system control, these unauthorized actions could compromise project integrity and confidentiality.

Hi! I’m here to help you understand CVE-2025-0504. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70