PT-2025-20473 · Sparx Systems · Sparx Systems Pro Cloud Server

Mikko Korpi + 1 · Publicado 2025-05-09 · Atualizado 2025-05-09 · CVE-2025-4375

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Sparx Systems Pro Cloud Server versions earlier than 6.0.165

Description A Cross-Site Request Forgery (CSRF) issue is present in the whole application, allowing for Session Hijacking. This issue can be used to change the Pro Cloud Server Configuration password.

Recommendations For versions earlier than 6.0.165, update to version 6.0.165 or later to resolve the issue. As a temporary workaround, consider restricting access to the configuration password change functionality to minimize the risk of exploitation.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2025-4375

Produtos afetados

Sparx Systems Pro Cloud Server

Referências · 4

• https://t.me/cvetracker/23446 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1920709319361704335 · Publicação no Twitter
• https://sparxsystems.com/products/procloudserver/6.1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-4375 · Nota de Segurança