« Volver al listado

CVE-2025-6504

Estado: AnalizadaAlta (8.4)—

In HDP Server versions below 4.6.2.2978 on Linux, unauthorized access could occur via IP spoofing using the X-Forwarded-For header.

Since XFF is a client-controlled header, it could be spoofed, allowing unauthorized access if the spoofed IP matched a whitelisted range.

This vulnerability could be exploited to bypass IP restrictions, though valid user credentials would still be required for resource access.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Inferido por reglas deterministas a partir del vector CVSS y la CWE. Solo orientativo.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Update SoftwareVulnerability ScanningApplication Isolation and SandboxingExploit Protection

Tecnologías afectadas (1)

Progress — Hybrid Data Pipeline

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-6504",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-6504",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-29T13:26:59.758939Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@progress.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.4,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 1.7
      }
    ]
  },
  "affected": [
    {
      "source": "security@progress.com",
      "affectedData": [
        {
          "vendor": "Progress Software",
          "modules": [
            "IP White Listing"
          ],
          "product": "Hybrid Data Pipeline",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "4.6.2.2978",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "Linux"
          ],
          "packageName": "HDP Server",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-07-29T13:15:28.650",
  "references": [
    {
      "url": "https://community.progress.com/s/article/DataDirect-Hybrid-Data-Pipeline-Critical-Security-Product-Alert-Bulletin-July-2025---CVE-2025-6504",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@progress.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-345"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In HDP Server versions below 4.6.2.2978 on Linux, unauthorized access could occur via IP spoofing using the X-Forwarded-For header. \n\nSince XFF is a client-controlled header, it could be spoofed, allowing unauthorized access if the spoofed IP matched a whitelisted range.\n\n\nThis vulnerability could be exploited to bypass IP restrictions, though valid user credentials would still be required for resource access."
    },
    {
      "lang": "es",
      "value": "En versiones de HDP Server anteriores a la 4.6.2.2978 en Linux, se podía producir acceso no autorizado mediante suplantación de IP mediante el encabezado X-Forwarded-For. Dado que XFF es un encabezado controlado por el cliente, podría suplantarse, permitiendo el acceso no autorizado si la IP suplantada coincidía con un rango permitido. Esta vulnerabilidad podría explotarse para eludir las restricciones de IP, aunque se seguirían necesitando credenciales de usuario válidas para acceder a los recursos."
    }
  ],
  "lastModified": "2026-06-17T10:02:02.237",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:progress:hybrid_data_pipeline:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "806425E3-2E1C-412F-AF38-BD522D436EDB",
              "versionEndExcluding": "4.6.2.2978"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "security@progress.com"
}