CVE-2025-15624 - CVE House
Back to Database
Status published Critical CVE-2025-15624

Plaintext Storage of a Password in Sparx Pro Cloud Server.

Vulnerability Description

Plaintext Storage of a Password vulnerability in Sparx Systems Pty Ltd. Sparx Pro Cloud Server.  In a setup where OpenID is used as the primary method of authentication to authenticate to Sparx EA, Pro Cloud Server creates local passwords to the users and stores them in plaintext.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-15624

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Pasi Orovuo, Solita Oy
  • Henri Hämäläinen, Solita Oy
  • Samu Ahvenainen, Solita Oy

References

More from Sparx Systems Pty Ltd.

View All →
CVE-2025-15625
Unauthenticated execution of arbitrary SQL queries in Sparx Pro Cloud Server
Critical 9.5
CVE-2025-15623
Sparx Pro Cloud Server reveals sensitive information to an unauthenticated user
Critical 9.3
CVE-2025-15622
Sparx Enterprise Architect Client reveals plaintext OAuth2 client secret
Medium 6.2
CVE-2025-15621
Sparx Enterprise Architect Client does not verify the receiver of OAuth2 credentials during OpenID authentication
Medium 5.7

Affected Vendor

Sparx Systems Pty Ltd.

View all reports →

Affected Software

Sparx Pro Cloud Server
Vulnerable Versions:
6.0.163

Timeline

Official Publish: April 17th, 2026
Last Modified: April 17th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-256

MITRE ATT&CK TTPs

T1552 Unsecured Credentials
Credential Access
T1005 Data from Local System
Collection
T1078 Valid Accounts
Persistence