CVE-2025-4377

Path traversal vulnerability in Sparx Pro Cloud Server WebEA webconfig in logview.php

State: Published
Severity: 8.3 High
Published: May 9, 2025
Updated: May 9, 2025
Reserved: May 6, 2025

Read the record on cve.org

Description

Improper Limitation of a Pathname caused a Path Traversal vulnerability in Sparx Systems Pro Cloud Server.

This vulnerability is present in logview.php and it allows reading arbitrary files on the filesystem.

Logview is accessible on Pro Cloud Server Configuration interface.

This issue affects Pro Cloud Server: earlier than 6.0.165.

Scores

CVSS	Score	Vector	Source
4.0	8.3 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:N/SA:N	NCSC-FI

Weaknesses

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-20 Improper Input Validation

Affected Products

Product	Versions
Pro Cloud ServerSparx Systems	6.0.163 and earlierAffected 6.0.165Not affected

References

https://sparxsystems.com/products/procloudserver/6.1/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.