PT-2025-20473 · Sparx Systems · Sparx Systems Pro Cloud Server

Mikko Korpi + 1 · Published 2025-05-09 · Updated 2025-05-09 · CVE-2025-4375

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Sparx Systems Pro Cloud Server versions earlier than 6.0.165

Description A Cross-Site Request Forgery (CSRF) issue is present in the whole application, allowing for Session Hijacking. This issue can be used to change the Pro Cloud Server Configuration password.

Recommendations For versions earlier than 6.0.165, update to version 6.0.165 or later to resolve the issue. As a temporary workaround, consider restricting access to the configuration password change functionality to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-4375

Affected Products

Sparx Systems Pro Cloud Server

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-4375 · Security Note
• https://t.me/cvetracker/23446 · Telegram Post
• https://twitter.com/CVEnew/status/1920709319361704335 · Twitter Post
• https://sparxsystems.com/products/procloudserver/6.1 · Note