CVE-2025-6504

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-6504", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "state": "PUBLISHED", "assignerShortName": "ProgressSoftware", "dateReserved": "2025-06-23T02:43:49.210Z", "datePublished": "2025-07-29T12:56:28.054Z", "dateUpdated": "2025-07-29T13:27:02.851Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["IP White Listing"], "packageName": "HDP Server", "platforms": ["Linux"], "product": "Hybrid Data Pipeline", "vendor": "Progress Software", "versions": [{"lessThan": "4.6.2.2978", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">In HDP Server versions below 4.6.2.2978 on Linux, unauthorized access could occur via IP spoofing using the X-Forwarded-For header.&nbsp;\n\nSince XFF is a client-controlled header, it could be spoofed, allowing unauthorized access if the spoofed IP matched a whitelisted range.\n\n<br><span style=\"background-color: rgb(255, 255, 255);\">This vulnerability could be exploited to bypass IP restrictions, though valid user credentials would still be required for resource access.</span>\n\n</span>"}], "value": "In HDP Server versions below 4.6.2.2978 on Linux, unauthorized access could occur via IP spoofing using the X-Forwarded-For header.\u00a0\n\nSince XFF is a client-controlled header, it could be spoofed, allowing unauthorized access if the spoofed IP matched a whitelisted range.\n\n\nThis vulnerability could be exploited to bypass IP restrictions, though valid user credentials would still be required for resource access."}], "impacts": [{"descriptions": [{"lang": "en", "value": "Attackers may bypass IP whitelisting to access restricted resources or UI interface."}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"description": "Unauthorized Access to Sensitive resources", "lang": "en"}]}], "providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2025-07-29T12:56:28.054Z"}, "references": [{"url": "https://community.progress.com/s/article/DataDirect-Hybrid-Data-Pipeline-Critical-Security-Product-Alert-Bulletin-July-2025---CVE-2025-6504"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Update the HDP Server to version 4.6.2.2978 or later.</span>"}], "value": "Update the HDP Server to version 4.6.2.2978 or later."}], "source": {"defect": ["HDP-10769"], "discovery": "INTERNAL"}, "title": "Possibilities of IP Spoofing via X-Forwarded-For (XFF) Header", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-345", "lang": "en", "description": "CWE-345 Insufficient Verification of Data Authenticity"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-29T13:26:59.758939Z", "id": "CVE-2025-6504", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-29T13:27:02.851Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-6504", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-07-29T13:26:59.758939Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-345", "description": "CWE-345 Insufficient Verification of Data Authenticity"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-29T13:26:51.760Z"}}], "cna": {"title": "Possibilities of IP Spoofing via X-Forwarded-For (XFF) Header", "source": {"defect": ["HDP-10769"], "discovery": "INTERNAL"}, "impacts": [{"descriptions": [{"lang": "en", "value": "Attackers may bypass IP whitelisting to access restricted resources or UI interface."}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Progress Software", "modules": ["IP White Listing"], "product": "Hybrid Data Pipeline", "versions": [{"status": "affected", "version": "0", "lessThan": "4.6.2.2978", "versionType": "custom"}], "platforms": ["Linux"], "packageName": "HDP Server", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update the HDP Server to version 4.6.2.2978 or later.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">Update the HDP Server to version 4.6.2.2978 or later.</span>", "base64": false}]}], "references": [{"url": "https://community.progress.com/s/article/DataDirect-Hybrid-Data-Pipeline-Critical-Security-Product-Alert-Bulletin-July-2025---CVE-2025-6504"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "In HDP Server versions below 4.6.2.2978 on Linux, unauthorized access could occur via IP spoofing using the X-Forwarded-For header.\u00a0\n\nSince XFF is a client-controlled header, it could be spoofed, allowing unauthorized access if the spoofed IP matched a whitelisted range.\n\n\nThis vulnerability could be exploited to bypass IP restrictions, though valid user credentials would still be required for resource access.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">In HDP Server versions below 4.6.2.2978 on Linux, unauthorized access could occur via IP spoofing using the X-Forwarded-For header.&nbsp;\n\nSince XFF is a client-controlled header, it could be spoofed, allowing unauthorized access if the spoofed IP matched a whitelisted range.\n\n<br><span style=\"background-color: rgb(255, 255, 255);\">This vulnerability could be exploited to bypass IP restrictions, though valid user credentials would still be required for resource access.</span>\n\n</span>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Unauthorized Access to Sensitive resources"}]}], "providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2025-07-29T12:56:28.054Z"}}}, "cveMetadata": {"cveId": "CVE-2025-6504", "state": "PUBLISHED", "dateUpdated": "2025-07-29T13:27:02.851Z", "dateReserved": "2025-06-23T02:43:49.210Z", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "datePublished": "2025-07-29T12:56:28.054Z", "assignerShortName": "ProgressSoftware"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "modules": ["IP White Listing"], "packageName": "HDP Server", "platforms": ["Linux"], "product": "Hybrid Data Pipeline", "vendor": "Progress Software", "versions": [{"lessThan": "4.6.2.2978", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "security@progress.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:progress:hybrid_data_pipeline:*:*:*:*:*:*:*:*", "matchCriteriaId": "806425E3-2E1C-412F-AF38-BD522D436EDB", "versionEndExcluding": "4.6.2.2978", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In HDP Server versions below 4.6.2.2978 on Linux, unauthorized access could occur via IP spoofing using the X-Forwarded-For header.\u00a0\n\nSince XFF is a client-controlled header, it could be spoofed, allowing unauthorized access if the spoofed IP matched a whitelisted range.\n\n\nThis vulnerability could be exploited to bypass IP restrictions, though valid user credentials would still be required for resource access."}, {"lang": "es", "value": "En versiones de HDP Server anteriores a la 4.6.2.2978 en Linux, se pod\u00eda producir acceso no autorizado mediante suplantaci\u00f3n de IP mediante el encabezado X-Forwarded-For. Dado que XFF es un encabezado controlado por el cliente, podr\u00eda suplantarse, permitiendo el acceso no autorizado si la IP suplantada coincid\u00eda con un rango permitido. Esta vulnerabilidad podr\u00eda explotarse para eludir las restricciones de IP, aunque se seguir\u00edan necesitando credenciales de usuario v\u00e1lidas para acceder a los recursos."}], "id": "CVE-2025-6504", "lastModified": "2026-06-17T10:02:02.237", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 6.0, "source": "security@progress.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-6504", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-07-29T13:26:59.758939Z", "version": "2.0.3"}}]}, "published": "2025-07-29T13:15:28.650", "references": [{"source": "security@progress.com", "tags": ["Vendor Advisory"], "url": "https://community.progress.com/s/article/DataDirect-Hybrid-Data-Pipeline-Critical-Security-Product-Alert-Bulletin-July-2025---CVE-2025-6504"}], "sourceIdentifier": "security@progress.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-345"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"created": "2025-07-30T11:10:26.412004+00:00", "updated": "2025-07-30T11:10:26.412086+00:00", "vendors": ["progress", "progress$PRODUCT$hybrid_data_pipeline"]}