CVE-2025-15624

In a configuration where OpenID is the primary authentication method for Sparx EA via Pro Cloud Server, the application creates local users and generates passwords for them. The generated passwords are then stored in the data store in plaintext form, without applying hashing or encryption mechanisms. An attacker or unauthorized person with access to the database or server configuration files can read these passwords directly without the need to crack them.

An attacker with access to the server's file system or database can read passwords of all local user accounts in plaintext form, enabling account takeover and unauthorized access to the Sparx EA environment.

Apply patches available from the vendor according to references — Sparx Pro Cloud Server 6.1 release history is available at https://sparxsystems.com/products/procloudserver/6.1/history.html. Until the update is applied, it is recommended to restrict access to configuration files and server database exclusively to authorized administrators and monitor access to these resources.

Sparx Pro Cloud Server — versions indicated in vendor references (release history available at: https://sparxsystems.com/products/procloudserver/6.1/history.html); the issue affects configurations with OpenID enabled as the primary authentication method.