CVE-2025-15624

Plaintext Storage of a Password vulnerability in Sparx Systems Pty Ltd. Sparx Pro Cloud Server. In a setup where OpenID is used as the primary method of authentication to authenticate to Sparx EA, Pro Cloud Server creates local passwords to the users and stores them in plaintext.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://sparxsystems.com/products/procloudserver/6.1/history.html	Release Notes

Configurations

Configuration 1 (hide)

cpe:2.3:a:sparxsystems:pro_cloud_server:6.0.163:*:*:*:*:*:*:*

History

30 Sep 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de almacenamiento de una contraseña en texto plano en Sparx Systems Pty Ltd. Sparx Pro Cloud Server. En una configuración donde OpenID se utiliza como método principal de autenticación para autenticarse en Sparx EA, Pro Cloud Server crea contraseñas locales para los usuarios y las almacena en texto plano.

Information

Published : 2026-04-17 09:16

Updated : 2026-10-07 09:10

NVD link : CVE-2025-15624

Mitre link : CVE-2025-15624

CVE.ORG link : CVE-2025-15624

JSON object : View

Products Affected

sparxsystems

pro_cloud_server

CWE

CWE-256

Plaintext Storage of a Password

{"id": "CVE-2025-15624", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15624", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-17T11:53:16.068396Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "db4dfee8-a97e-4877-bfae-eba6d14a2166", "cvssData": {"Safety": "PRESENT", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:C/RE:M/U:Red", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "RED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "MODERATE", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "db4dfee8-a97e-4877-bfae-eba6d14a2166", "affectedData": [{"vendor": "Sparx Systems Pty Ltd.", "product": "Sparx Pro Cloud Server", "versions": [{"status": "affected", "version": "6.0.163"}], "defaultStatus": "unknown"}]}], "published": "2026-04-17T09:16:04.723", "references": [{"url": "https://sparxsystems.com/products/procloudserver/6.1/history.html", "tags": ["Release Notes"], "source": "db4dfee8-a97e-4877-bfae-eba6d14a2166"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "db4dfee8-a97e-4877-bfae-eba6d14a2166", "description": [{"lang": "en", "value": "CWE-256"}]}], "descriptions": [{"lang": "en", "value": "Plaintext Storage of a Password vulnerability in Sparx Systems Pty Ltd. Sparx Pro Cloud Server.\u00a0\nIn a setup where OpenID is used as the primary method of authentication to authenticate to Sparx EA, Pro Cloud Server creates local passwords to the users and stores them in plaintext."}, {"lang": "es", "value": "Vulnerabilidad de almacenamiento de una contrase\u00f1a en texto plano en Sparx Systems Pty Ltd. Sparx Pro Cloud Server.\nEn una configuraci\u00f3n donde OpenID se utiliza como m\u00e9todo principal de autenticaci\u00f3n para autenticarse en Sparx EA, Pro Cloud Server crea contrase\u00f1as locales para los usuarios y las almacena en texto plano."}], "lastModified": "2026-10-07T09:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sparxsystems:pro_cloud_server:6.0.163:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BAD11AE8-3D86-4FBD-89D7-5F4F0293A406"}], "operator": "OR"}]}], "sourceIdentifier": "db4dfee8-a97e-4877-bfae-eba6d14a2166"}