Plaintext Storage of a Password in Sparx Pro Cloud Server.
Priority MEDIUM 48CWE-256Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-256.
Summary
Plaintext Storage of a Password vulnerability in Sparx Systems Pty Ltd. Sparx Pro Cloud Server. In a setup where OpenID is used as the primary method of authentication to authenticate to Sparx EA, Pro Cloud Server creates local passwords to the users and stores them in plaintext.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0038 32nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Sparx Systems | Sparx Pro Cloud Server | 6.0.163 | — | No fix listed | CNA |
- Sparx Pro Cloud Server VendorSparx Systems Affected 6.0.163 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sparxsystems:pro_cloud_server:6.0.163:*:*:*:*:*:*:* | 6.0.163 | Vulnerable | Sparx Systems |
- cpe:2.3:a:sparxsystems:pro_cloud_server:6.0.163:*:*:*:*:*:*:* Versions 6.0.163 Vulnerable ·Sparx Systems
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-15624
- 2026-10-03 Alias added: GHSA-9gf7-444h-6v98
References
More Sparx Systems Pro Cloud Server vulnerabilities
- TI-2026-30463 Authentication Bypass in Sparx Pro Cloud Server CVSS 4.0CRITICAL 9.3
- TI-2025-14251 Sparx Pro Cloud Server reveals sensitive information to an unauthenticated user CVSS 4.0CRITICAL 9.3
- TI-2026-30462 Broken Access Control in Sparx Pro Cloud Server CVSS 4.0HIGH 8.7
- TI-2025-14253 Unauthenticated execution of arbitrary SQL queries in Sparx Pro Cloud Server CVSS 4.0CRITICAL 9.5
- TI-2026-30465 Race Condition in Sparx Pro Cloud Server CVSS 4.0HIGH 7.7
- TI-2026-30466 DoS in Sparx Pro Cloud Server CVSS 4.0HIGH 7.1
Sources
- CVE-2025-15624 · CVE Program
- CVE-2025-15624 · NVD
- FIRST EPSS
- GHSA-9gf7-444h-6v98 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences