User Role Misconfiguration in Black Duck SCA by Synopsys

CVE-2025-0504

What is CVE-2025-0504?

The vulnerability arises from the misconfiguration of user role permissions in Black Duck SCA, particularly affecting versions prior to 2025.10.0. The Project Manager role, by design, possesses Global User Read access, inadvertently allowing users to access critical functionalities reserved for Project Administrators. While this does not provide full system control, it potentially enables unauthorized modifications to project settings and the possibility of accessing sensitive project information, which could compromise the security and integrity of the system.

References