CVE-2025-15624

Plaintext Storage of a Password in Sparx Pro Cloud Server.

State: Published
Severity: 9.3 Critical
Published: Apr 17, 2026
Updated: Apr 17, 2026
Reserved: Apr 9, 2026

Description

Plaintext Storage of a Password vulnerability in Sparx Systems Pty Ltd. Sparx Pro Cloud Server. In a setup where OpenID is used as the primary method of authentication to authenticate to Sparx EA, Pro Cloud Server creates local passwords to the users and stores them in plaintext.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/S:P/AU:Y/V:C/RE:M/U:Red	NCSC-FI

Weaknesses

CWE-256 Plaintext Storage of a Password

Affected Products

Product	Versions
Sparx Pro Cloud ServerSparx Systems Pty Ltd.	6.0.163Affected

References

https://sparxsystems.com/products/procloudserver/6.1/history.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.