VulnerabilityAnalyzed

CVE-2025-15624

Plaintext Storage of a Password vulnerability in Sparx Systems Pty Ltd.

CRITICAL 9.3EPSS 0.38%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.38%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Plaintext Storage of a Password vulnerability in Sparx Systems Pty Ltd. Sparx Pro Cloud Server. In a setup where OpenID is used as the primary method of authentication to authenticate to Sparx EA, Pro Cloud Server creates local passwords to the users and stores them in plaintext.

CVSS 4.0: 9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.38% probability · 31th percentile
CISA KEV: Not listed
Weakness: CWE-256
Affected: sparxsystems/pro cloud server
Source: db4dfee8-a97e-4877-bfae-eba6d14a2166

References

https://sparxsystems.com/products/procloudserver/6.1/history.htmlRelease Notes

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.