CVE-2025-0504: Black Duck SCA Project Privilege Escalation
Black Duck SCA versions prior to 2025.10.0 had user role permissions configured in an overly broad manner. Users with the scoped Project Manager user role with the Global User Read access permission enabled access to certain Project Administrator functionalities which should have be inaccessible. Exploitation does not grant full system control, but it may enable unauthorized changes to project configurations or access to system sensitive information.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0504?
CVE-2025-0504 is considered a medium severity vulnerability due to its impact on user permissions within the Black Duck SCA.
How do I fix CVE-2025-0504?
To fix CVE-2025-0504, upgrade to Black Duck SCA version 2025.10.0 or later.
What versions of Black Duck SCA are affected by CVE-2025-0504?
Black Duck SCA versions prior to 2025.10.0 are affected by CVE-2025-0504.
What does CVE-2025-0504 affect in Black Duck SCA?
CVE-2025-0504 affects user role permissions, allowing scoped Project Manager users unintended access to Project Administrator functionalities.
Is there a risk of exploitation of CVE-2025-0504?
Yes, the misconfiguration in user permissions poses a risk of unauthorized access to sensitive functionalities in Black Duck SCA.