VulnerabilityAwaiting Analysis

CVE-2025-15622

Insufficiently Protected Credentials vulnerability in Sparx Systems Pty Ltd.

MEDIUM 6.2EPSS 0.15%

Does this matter?

Lower severity and a low EPSS score (0.15%). Track it; it rarely justifies an emergency change on its own.

Description

Insufficiently Protected Credentials vulnerability in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client reveals plaintext OAuth2 client secretDesktop client decodes the secret and uses the plaintext secret to exchange it into an access and id tokens as part of the OpenID authentication flow.

CVSS 4.0: 6.2 MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.15% probability · 5th percentile
CISA KEV: Not listed
Weakness: CWE-522
Source: db4dfee8-a97e-4877-bfae-eba6d14a2166

References

https://sparxsystems.com/products/ea/17.1/history.html

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.