CVE-2025-2903: perforce delphix Privilege Defined With Unsafe Actions
Vulnerability summary
CVE-2025-2903 is a high (CVSS 8.5) Privilege Defined With Unsafe Actions vulnerability in perforce delphix. EPSS estimates a 0.20% chance of exploitation in the next 30 days, higher than 9.6% of scored vulnerabilities.
Timeline
- 17-04-2025PublishedVulnerability first disclosed.
- 17-04-2025Last modifiedVulnerability information updated.
Description
An attacker with knowledge of creating user accounts during VM deployment on Google Cloud Platform (GCP) using the OS Login feature, can login via SSH gaining command-line control of the operating system. This allows an attacker to gain access to sensitive data stored on the VM, install malicious software, and disrupt or disable the functionality of the VM.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST8.5HighCVSS:4.0/AV:P/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.20%
Chance of exploitation in the next 30 days
Percentile
10%
Versus all other CVEs
30-day change
0.00 pp
From 0.20% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-267Privilege Defined With Unsafe ActionsA particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended, even when it is assigned to the correct entity.
- CWE-268Privilege ChainingTwo distinct privileges, roles, capabilities, or rights can be combined in a way that allows an entity to perform unsafe actions that would not be allowed without that combination.
Affected systems
Perforce1 product
- delphix≥ 14.0.0.0, ≤ 2025.2.0.0
1 vendor · 1 product