CVE-2025-4375

Cross-Site Request Forgery (CSRF) vulnerability in Sparx Systems Pro Cloud Server allows Cross-Site Request Forgery to perform Session Hijacking. Cross-Site Request Forgery is present at the whole application but it can be used to change the Pro Cloud Server Configuration password. This issue affects Pro Cloud Server: earlier than 6.0.165.

CVSS

No CVSS.

References

Link	Resource
https://sparxsystems.com/products/procloudserver/6.1/

Configurations

No configuration.

History

12 May 2025, 17:32

Type	Values Removed	Values Added
Summary		(es) La vulnerabilidad de Cross-Site Request Forgery (CSRF) en Sparx Systems Pro Cloud Server permite que esta vulnerabilidad realice secuestros de sesión. Esta vulnerabilidad está presente en toda la aplicación, pero puede utilizarse para cambiar la contraseña de configuración de Pro Cloud Server. Este problema afecta a Pro Cloud Server: versiones anteriores a la 6.0.165.

09 May 2025, 06:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-05-09 06:15

Updated : 2025-05-12 17:32

NVD link : CVE-2025-4375

Mitre link : CVE-2025-4375

CVE.ORG link : CVE-2025-4375

JSON object : View

Products Affected

No product.

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2025-4375", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "db4dfee8-a97e-4877-bfae-eba6d14a2166", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-05-09T06:15:37.687", "references": [{"url": "https://sparxsystems.com/products/procloudserver/6.1/", "source": "db4dfee8-a97e-4877-bfae-eba6d14a2166"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "db4dfee8-a97e-4877-bfae-eba6d14a2166", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "Cross-Site Request Forgery (CSRF) vulnerability in Sparx Systems Pro Cloud Server allows Cross-Site Request Forgery to perform Session Hijacking. Cross-Site Request Forgery is present at the whole application but it can be used to change the Pro Cloud Server Configuration password. \nThis issue affects Pro Cloud Server: earlier than 6.0.165."}, {"lang": "es", "value": "La vulnerabilidad de Cross-Site Request Forgery (CSRF) en Sparx Systems Pro Cloud Server permite que esta vulnerabilidad realice secuestros de sesi\u00f3n. Esta vulnerabilidad est\u00e1 presente en toda la aplicaci\u00f3n, pero puede utilizarse para cambiar la contrase\u00f1a de configuraci\u00f3n de Pro Cloud Server. Este problema afecta a Pro Cloud Server: versiones anteriores a la 6.0.165."}], "lastModified": "2025-05-12T17:32:52.810", "sourceIdentifier": "db4dfee8-a97e-4877-bfae-eba6d14a2166"}