CVE-2025-15621

Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 credentials during OpenID authentication

CVSS v3 6.0 MEDIUM

6.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://sparxsystems.com/products/ea/17.1/history.html	Release Notes

Configurations

Configuration 1 (hide)

cpe:2.3:a:sparxsystems:enterprise_architect:*:*:*:*:*:*:*:*

History

30 Sep 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Credenciales insuficientemente protegidas en Sparx Systems Pty Ltd. Sparx Enterprise Architect. El cliente no verifica el receptor de las credenciales OAuth2 durante la autenticación OpenID

Information

Published : 2026-04-16 13:16

Updated : 2026-10-07 09:10

NVD link : CVE-2025-15621

Mitre link : CVE-2025-15621

CVE.ORG link : CVE-2025-15621

JSON object : View

Products Affected

sparxsystems

enterprise_architect

CWE

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2025-15621", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15621", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-16T12:51:32.874380Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.0, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 0.8}], "cvssMetricV40": [{"type": "Secondary", "source": "db4dfee8-a97e-4877-bfae-eba6d14a2166", "cvssData": {"Safety": "PRESENT", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.7, "Automatable": "YES", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:C/RE:M/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "MODERATE", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "db4dfee8-a97e-4877-bfae-eba6d14a2166", "affectedData": [{"vendor": "Sparx Systems Pty Ltd.", "product": "Sparx Enterprise Architect", "versions": [{"status": "affected", "version": "16.1.1627"}, {"status": "unaffected", "version": "17.1.1714"}], "defaultStatus": "unknown"}]}], "published": "2026-04-16T13:16:43.423", "references": [{"url": "https://sparxsystems.com/products/ea/17.1/history.html", "tags": ["Release Notes"], "source": "db4dfee8-a97e-4877-bfae-eba6d14a2166"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "db4dfee8-a97e-4877-bfae-eba6d14a2166", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 credentials during OpenID authentication"}, {"lang": "es", "value": "Credenciales insuficientemente protegidas en Sparx Systems Pty Ltd. Sparx Enterprise Architect. El cliente no verifica el receptor de las credenciales OAuth2 durante la autenticaci\u00f3n OpenID"}], "lastModified": "2026-10-07T09:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sparxsystems:enterprise_architect:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D756634-6D4C-4D63-862F-BB7874EBBC83", "versionEndExcluding": "17.1.1714", "versionStartIncluding": "16.1.1627"}], "operator": "OR"}]}], "sourceIdentifier": "db4dfee8-a97e-4877-bfae-eba6d14a2166"}