{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15623", "assignerOrgId": "db4dfee8-a97e-4877-bfae-eba6d14a2166", "state": "PUBLISHED", "assignerShortName": "NCSC-FI", "dateReserved": "2026-04-09T08:02:30.837Z", "datePublished": "2026-04-17T08:37:27.611Z", "dateUpdated": "2026-04-17T08:37:27.611Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "db4dfee8-a97e-4877-bfae-eba6d14a2166", "shortName": "NCSC-FI", "dateUpdated": "2026-04-17T08:37:27.611Z"}, "title": "Sparx Pro Cloud Server reveals sensitive information to an unauthenticated user", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-359", "description": "CWE-359: Exposure of Private Personal Information to an Unauthorized Actor", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-497", "description": "CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere", "type": "CWE"}]}], "affected": [{"vendor": "Sparx Systems Pty Ltd.", "product": "Sparx Pro Cloud Server", "versions": [{"status": "affected", "version": "6.0.163"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "Exposure of Private Personal Information to an Unauthorized Actor, : Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Sparx Systems Pty Ltd. Sparx Pro Cloud Server.\n\nUnauthenticated user can retrieve database password in plaintext in certain situations", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div><span>Exposure of Private Personal Information to an Unauthorized Actor, : Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Sparx Systems Pty Ltd. Sparx Pro Cloud Server.</span></div><p><span>Unauthenticated user can retrieve database password in plaintext in certain situations</span></p><p><br></p>"}]}], "references": [{"url": "https://sparxsystems.com/products/procloudserver/6.1/history.html"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "PRESENT", "Automatable": "YES", "Recovery": "NOT_DEFINED", "valueDensity": "CONCENTRATED", "vulnerabilityResponseEffort": "MODERATE", "providerUrgency": "RED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/S:P/AU:Y/V:C/RE:M/U:Red"}}], "credits": [{"lang": "en", "value": "Pasi Orovuo, Solita Oy", "type": "finder"}, {"lang": "en", "value": "Henri H\u00e4m\u00e4l\u00e4inen, Solita Oy", "type": "finder"}, {"lang": "en", "value": "Samu Ahvenainen, Solita Oy", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.0"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Exposure of Private Personal Information to an Unauthorized Actor, : Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Sparx Systems Pty Ltd. Sparx Pro Cloud Server.\n\nUnauthenticated user can retrieve database password in plaintext in certain situations"}], "id": "CVE-2025-15623", "lastModified": "2026-04-17T09:16:04.593", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "YES", "Recovery": "NOT_DEFINED", "Safety": "PRESENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "RED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "CONCENTRATED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:C/RE:M/U:Red", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "MODERATE"}, "source": "db4dfee8-a97e-4877-bfae-eba6d14a2166", "type": "Secondary"}]}, "published": "2026-04-17T09:16:04.593", "references": [{"source": "db4dfee8-a97e-4877-bfae-eba6d14a2166", "url": "https://sparxsystems.com/products/procloudserver/6.1/history.html"}], "sourceIdentifier": "db4dfee8-a97e-4877-bfae-eba6d14a2166", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-359"}, {"lang": "en", "value": "CWE-497"}], "source": "db4dfee8-a97e-4877-bfae-eba6d14a2166", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-17T10:21:24.085090+00:00", "value": {"mitigation_remediation": ["Apply the latest Sparx Pro Cloud Server patch or upgrade to a version that removes the plaintext password retrieval flaw.", "If a patch is not immediately available, change the database password to a strong, unique value and ensure it is stored in an encrypted form.", "Restrict network access to the Sparx Pro Cloud Server by limiting it to trusted hosts and enabling firewall rules to block unauthenticated requests to the vulnerable endpoints."], "summary": {"action": "Patch Immediately", "impact": "Plaintext database password disclosure"}, "threat_synthesis": {"affected_systems": "The affected product is Sparx Pro Cloud Server provided by Sparx Systems Pty Ltd. No specific version number was supplied in the public data, so any release that has not yet been confirmed as patched remains vulnerable.", "description_and_impact": "The vulnerability presents an improper information disclosure where an unauthenticated user can retrieve the database password exposed in plaintext. This exposes sensitive system credentials, permitting attackers to authenticate to the underlying database or compromise other services. The weakness aligns with CWE-359 and CWE-497 semantics.", "risk_and_exploitability": "The CVSS score of 9.3 places the vulnerability in the critical range, indicating that exploitation is high risk. Although no EPSS score is supplied, the lack of existing measures and the straightforward nature of retrieving a password from an unauthenticated request suggest that attackers can easily exploit the flaw. The vulnerability is not yet listed in the CISA KEV catalog, but the high CVSS and exposure of credentials warrant immediate action. An attacker with network access to the Sparx Pro Cloud Server can potentially send a crafted request and obtain the database password in plaintext without needing to authenticate."}}}}, "created": "2026-04-17T10:30:12.992383+00:00", "updated": "2026-04-17T10:30:12.992395+00:00", "vendors": []}