PT-2025-31201 · Progress · Hybrid Data Pipeline Server

Published 2025-07-29 · Updated 2025-08-03 · CVE-2025-6505

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Progress Software Hybrid Data Pipeline Server versions 4.6.2.3226 and below

Description The Hybrid Data Pipeline Server is susceptible to unauthorized access and impersonation. Attackers can combine credentials from multiple sources, potentially leading to client impersonation and unauthorized access. During an OAuth handshake, the server accepts client credentials from both HTTP headers and request parameters.

Recommendations Update to a version later than 4.6.2.3226.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2025-6505

Affected Products

Hybrid Data Pipeline Server

References · 6

• https://osv.dev/vulnerability/CVE-2025-6505 · Vendor Advisory
• https://community.progress.com/s/article/DataDirect-Hybrid-Data-Pipeline-Critical-Security-Product-Alert-Bulletin-July-2025---CVE-2025-6505 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6505 · Security Note
• https://t.me/CVEtracker/28665 · Telegram Post
• https://twitter.com/cracbot/status/1951961293411250459 · Twitter Post
• https://twitter.com/CVEnew/status/1950186956668764395 · Twitter Post