CVE Alert: CVE-2025-6504

Vulnerability Summary: CVE-2025-6504

In HDP Server versions below 4.6.2.2978 on Linux, unauthorized access could occur via IP spoofing using the X-Forwarded-For header. Since XFF is a client-controlled header, it could be spoofed, allowing unauthorized access if the spoofed IP matched a whitelisted range. This vulnerability could be exploited to bypass IP restrictions, though valid user credentials would still be required for resource access.

Affected Endpoints:

No affected endpoints listed.

Published Date:

7/29/2025, 1:15:28 PM

🔥 CVSS Score:

Exploit Status:

Not Exploited

References:

• https://community.progress.com/s/article/DataDirect-Hybrid-Data-Pipeline-Critical-Security-Product-Alert-Bulletin-July-2025—CVE-2025-6504

Recommended Action:

No proposed action available. Please refer to vendor documentation for updates.

---