CVE-2025-15624

CRITICAL

Plaintext Storage of a Password in Sparx Pro Cloud Server.

Title source: cna

Description

Plaintext Storage of a Password vulnerability in Sparx Systems Pty Ltd. Sparx Pro Cloud Server. In a setup where OpenID is used as the primary method of authentication to authenticate to Sparx EA, Pro Cloud Server creates local passwords to the users and stores them in plaintext.

References (1)

https://sparxsystems.com/products/procloudserver/6.1/history.html

Scores

CVSS v4 9.3

EPSS 0.0003

EPSS Percentile 7.0%

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/S:P/AU:Y/V:C/RE:M/U:Red

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-256

Status published

Products (1)

Sparx Systems Pty Ltd./Sparx Pro Cloud Server 6.0.163

Published Apr 17, 2026

Tracked Since Apr 17, 2026