CVE-2025-15624

Plaintext Storage of a Password vulnerability in Sparx Systems Pty Ltd. Sparx Pro Cloud Server. In a setup where OpenID is used as the primary method of authentication to authenticate to Sparx EA, Pro Cloud Server creates local passwords to the users and stores them in plaintext.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://sparxsystems.com/products/procloudserver/6.1/history.html	Release Notes

Configurations

Configuration 1 (hide)

cpe:2.3:a:sparxsystems:pro_cloud_server:6.0.163:*:*:*:*:*:*:*

History

02 Jun 2026, 14:26

Type	Values Removed	Values Added
First Time		Sparxsystems pro Cloud Server Sparxsystems
References	~~() https://sparxsystems.com/products/procloudserver/6.1/history.html -~~	() https://sparxsystems.com/products/procloudserver/6.1/history.html - Release Notes
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 7.5
CPE		cpe:2.3:a:sparxsystems:pro_cloud_server:6.0.163:::::::*

17 Apr 2026, 09:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-04-17 09:16

Updated : 2026-06-02 14:26

NVD link : CVE-2025-15624

Mitre link : CVE-2025-15624

CVE.ORG link : CVE-2025-15624

JSON object : View

Products Affected

sparxsystems

pro_cloud_server

CWE

CWE-256

Plaintext Storage of a Password

{"id": "CVE-2025-15624", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "db4dfee8-a97e-4877-bfae-eba6d14a2166", "cvssData": {"Safety": "PRESENT", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:C/RE:M/U:Red", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "RED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "MODERATE", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-04-17T09:16:04.723", "references": [{"url": "https://sparxsystems.com/products/procloudserver/6.1/history.html", "tags": ["Release Notes"], "source": "db4dfee8-a97e-4877-bfae-eba6d14a2166"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "db4dfee8-a97e-4877-bfae-eba6d14a2166", "description": [{"lang": "en", "value": "CWE-256"}]}], "descriptions": [{"lang": "en", "value": "Plaintext Storage of a Password vulnerability in Sparx Systems Pty Ltd. Sparx Pro Cloud Server.\u00a0\nIn a setup where OpenID is used as the primary method of authentication to authenticate to Sparx EA, Pro Cloud Server creates local passwords to the users and stores them in plaintext."}], "lastModified": "2026-06-02T14:26:36.297", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sparxsystems:pro_cloud_server:6.0.163:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BAD11AE8-3D86-4FBD-89D7-5F4F0293A406"}], "operator": "OR"}]}], "sourceIdentifier": "db4dfee8-a97e-4877-bfae-eba6d14a2166"}