CVE-2025-6504

HighCVSS 8.4/10Last modified Jun 17, 2026

Description

In HDP Server versions below 4.6.2.2978 on Linux, unauthorized access could occur via IP spoofing using the X-Forwarded-For header. 

Since XFF is a client-controlled header, it could be spoofed, allowing unauthorized access if the spoofed IP matched a whitelisted range.

This vulnerability could be exploited to bypass IP restrictions, though valid user credentials would still be required for resource access.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-345

Affected software

No affected versions have been published.

Timeline

Published
Jul 29, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-650419.8Improper authorization in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.CVE-2025-650463.1Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2025-65058.1Unauthorized access and impersonation can occur in versions 4.6.2.3226 and below of Progress Software's Hybrid Data Pipeline Server on LinuxCVE-2025-65079.8A vulnerability in the h2oai/h2o-3 repository allows attackers to exploit deserialization of untrusted data, potentially leading to arbitrarCVE-2025-650737.5OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide KeCVE-2025-650747.2WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious attCVE-2025-650756.5WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious attCVE-2025-650766.1WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious attCVE-2025-650778.8A relative path traversal vulnerability has been identified in the Embedded Solutions Framework in various Lexmark devices. This vulnerabiliCVE-2025-650789.3An untrusted search path vulnerability has been identified in the Embedded Solutions Framework in various Lexmark devices. This vulnerabilitCVE-2025-650796.9A heap-based buffer overflow vulnerability has been identified in the Postscript interpreter in various Lexmark devices. This vulnerability CVE-2025-65084.3The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding
CVE-2025-6504: High severity, CVSS 8.4 | Vulnix