CVE-2025-2903

Privilege Chaining in Delphix

State: Published
Severity: 8.5 High
Published: Apr 17, 2025
Updated: Apr 17, 2025
Reserved: Mar 28, 2025

Description

An attacker with knowledge of creating user accounts during VM deployment on Google Cloud Platform (GCP) using the OS Login feature, can login via SSH gaining command-line control of the operating system. This allows an attacker to gain access to sensitive data stored on the VM, install malicious software, and disrupt or disable the functionality of the VM.

Scores

CVSS	Score	Vector	Source
4.0	8.5 High	CVSS:4.0/AV:P/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H	Perforce

Weaknesses

CWE-268 Privilege Chaining
CWE-267 Privilege Defined With Unsafe Actions

Affected Products

Product	Versions
DelphixPerforce	14.0.0.0 through 2025.2.0.0Affected

References

https://portal.perforce.com/s/detail/a91PA000001Sed3YAC

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.