2 lines
3.9 KiB
JSON
2 lines
3.9 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Black Duck SCA","vendor":"Black Duck","versions":[{"lessThan":"2025.10.0","status":"affected","version":"0","versionType":"custom"}]}],"source":"disclosure@synopsys.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Black Duck SCA versions prior to 2025.10.0 had user role permissions configured in an overly broad manner. Users with the scoped Project Manager user role with the Global User Read access permission enabled access to certain Project Administrator functionalities which should have be inaccessible. Exploitation does not grant full system control, but it may enable unauthorized changes to project configurations or access to system sensitive information."},{"lang":"es","value":"Las versiones de Black Duck SCA anteriores a 2025.10.0 tenían los permisos de rol de usuario configurados de forma demasiado amplia. Los usuarios con el rol de usuario de Project Manager con ámbito y con el permiso de acceso de Lectura de Usuario Global habilitado, accedían a ciertas funcionalidades de Administrador de Proyecto que deberían haber sido inaccesibles. La explotación no otorga control total del sistema, pero puede permitir cambios no autorizados en las configuraciones del proyecto o el acceso a información sensible del sistema."}],"id":"CVE-2025-0504","lastModified":"2026-10-08T10:10:00.227","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":2.5,"source":"disclosure@synopsys.com","type":"Secondary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"LOW","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"disclosure@synopsys.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-0504","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2025-11-21T21:56:58.914135Z","version":"2.0.3"}}]},"published":"2025-11-21T22:16:17.790","references":[{"source":"disclosure@synopsys.com","url":"https://community.blackduck.com/s/article/Black-Duck-Product-Security-Advisory-CVE-2025-0504"}],"sourceIdentifier":"disclosure@synopsys.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-266"}],"source":"disclosure@synopsys.com","type":"Secondary"}]}
|