PT-2025-47803 · Synopsys · Black Duck Sca

Published 2025-11-21 · Updated 2025-11-21 · CVE-2025-0504

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Black Duck SCA versions prior to 2025.10.0

Description User role permissions were configured in an overly broad manner in Black Duck SCA. Users with the Project Manager role and Global User Read access permission were able to access Project Administrator functionalities that should have been restricted. This does not grant full system control, but may allow unauthorized changes to project configurations or access to sensitive system information.

Recommendations Update Black Duck SCA to version 2025.10.0 or later.

Fix

LPE

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

CVE-2025-0504

Affected Products

Black Duck Sca

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-0504 · Security Note
• https://t.me/CVEtracker/37975 · Telegram Post
• https://community.blackduck.com/s/article/Black-Duck-Product-Security-Advisory-CVE-2025-0504 · Patch, Vendor Advisory
• https://twitter.com/CVEnew/status/1991985310427680921 · Twitter Post