PT-2025-31201 · Progress · Hybrid Data Pipeline Server

CVE-2025-6505 · Published 2025-07-29 · Updated 2025-08-03

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Progress Software Hybrid Data Pipeline Server versions 4.6.2.3226 and below

Description The Hybrid Data Pipeline Server is susceptible to unauthorized access and impersonation. Attackers can combine credentials from multiple sources, potentially leading to client impersonation and unauthorized access. During an OAuth handshake, the server accepts client credentials from both HTTP headers and request parameters.

Recommendations Update to a version later than 4.6.2.3226.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2025-6505

Affected Products

Hybrid Data Pipeline Server

References · 6

• https://osv.dev/vulnerability/CVE-2025-6505 · Vendor Advisory
• https://community.progress.com/s/article/DataDirect-Hybrid-Data-Pipeline-Critical-Security-Product-Alert-Bulletin-July-2025---CVE-2025-6505 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6505 · Security Note
• https://t.me/CVEtracker/28665 · Telegram Post
• https://twitter.com/cracbot/status/1951961293411250459 · Twitter Post
• https://twitter.com/CVEnew/status/1950186956668764395 · Twitter Post