CVE-2025-4377 (GCVE-0-2025-4377)
Vulnerability from cvelistv5
Published
2025-05-09 05:12
Modified
2025-05-09 13:22
Severity ?
VLAI Severity ?
EPSS score ?
CWE
Summary
Improper Limitation of a Pathname caused a Path Traversal vulnerability in Sparx Systems Pro Cloud Server.
This vulnerability is present in logview.php and it allows reading arbitrary files on the filesystem.
Logview is accessible on Pro Cloud Server Configuration interface.
This issue affects Pro Cloud Server: earlier than 6.0.165.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Sparx Systems | Pro Cloud Server |
Version: 0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-4377",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-09T13:22:04.482705Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-09T13:22:16.817Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://sparxsystems.com/products/procloudserver/",
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Pro Cloud Server",
"programFiles": [
"logview.php"
],
"vendor": "Sparx Systems",
"versions": [
{
"lessThanOrEqual": "6.0.163",
"status": "affected",
"version": "0",
"versionType": "PCS"
},
{
"status": "unaffected",
"version": "6.0.165",
"versionType": "PCS"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Santeri Siiril\u00e4"
},
{
"lang": "en",
"type": "finder",
"value": "Mikko Korpi"
}
],
"datePublic": "2025-05-05T06:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003eImproper Limitation of a Pathname caused a Path Traversal vulnerability in Sparx Systems Pro Cloud Server.\u003c/div\u003e\u003cdiv\u003eThis vulnerability is present in \u003ctt\u003elogview.php\u003c/tt\u003e and it allows reading arbitrary files on the filesystem.\u0026nbsp;\u003c/div\u003e\u003cdiv\u003eLogview is accessible on Pro Cloud Server Configuration interface. \u003cbr\u003e\u003c/div\u003e\u003cp\u003eThis issue affects Pro Cloud Server: earlier than 6.0.165.\u003c/p\u003e"
}
],
"value": "Improper Limitation of a Pathname caused a Path Traversal vulnerability in Sparx Systems Pro Cloud Server.\n\nThis vulnerability is present in logview.php and it allows reading arbitrary files on the filesystem.\u00a0\n\nLogview is accessible on Pro Cloud Server Configuration interface. \n\n\nThis issue affects Pro Cloud Server: earlier than 6.0.165."
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126: Path Traversal"
}
]
},
{
"capecId": "CAPEC-139",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-139: Relative Path Traversal"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-05-09T05:12:59.487Z",
"orgId": "db4dfee8-a97e-4877-bfae-eba6d14a2166",
"shortName": "NCSC-FI"
},
"references": [
{
"url": "https://sparxsystems.com/products/procloudserver/6.1/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Path traversal vulnerability in Sparx Pro Cloud Server WebEA webconfig in logview.php",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "db4dfee8-a97e-4877-bfae-eba6d14a2166",
"assignerShortName": "NCSC-FI",
"cveId": "CVE-2025-4377",
"datePublished": "2025-05-09T05:12:59.487Z",
"dateReserved": "2025-05-06T05:21:12.322Z",
"dateUpdated": "2025-05-09T13:22:16.817Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-4377\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-05-09T13:22:04.482705Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-05-09T13:22:07.967Z\"}}], \"cna\": {\"title\": \"Path traversal vulnerability in Sparx Pro Cloud Server WebEA webconfig in logview.php\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Santeri Siiril\\u00e4\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Mikko Korpi\"}], \"impacts\": [{\"capecId\": \"CAPEC-126\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-126: Path Traversal\"}]}, {\"capecId\": \"CAPEC-139\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-139: Relative Path Traversal\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 8.3, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:N/SA:N\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"HIGH\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"LOW\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"LOW\", \"subConfidentialityImpact\": \"HIGH\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Sparx Systems\", \"product\": \"Pro Cloud Server\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"PCS\", \"lessThanOrEqual\": \"6.0.163\"}, {\"status\": \"unaffected\", \"version\": \"6.0.165\", \"versionType\": \"PCS\"}], \"platforms\": [\"Windows\"], \"programFiles\": [\"logview.php\"], \"collectionURL\": \"https://sparxsystems.com/products/procloudserver/\", \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2025-05-05T06:00:00.000Z\", \"references\": [{\"url\": \"https://sparxsystems.com/products/procloudserver/6.1/\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Improper Limitation of a Pathname caused a Path Traversal vulnerability in Sparx Systems Pro Cloud Server.\\n\\nThis vulnerability is present in logview.php and it allows reading arbitrary files on the filesystem.\\u00a0\\n\\nLogview is accessible on Pro Cloud Server Configuration interface. \\n\\n\\nThis issue affects Pro Cloud Server: earlier than 6.0.165.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cdiv\u003eImproper Limitation of a Pathname caused a Path Traversal vulnerability in Sparx Systems Pro Cloud Server.\u003c/div\u003e\u003cdiv\u003eThis vulnerability is present in \u003ctt\u003elogview.php\u003c/tt\u003e and it allows reading arbitrary files on the filesystem.\u0026nbsp;\u003c/div\u003e\u003cdiv\u003eLogview is accessible on Pro Cloud Server Configuration interface. \u003cbr\u003e\u003c/div\u003e\u003cp\u003eThis issue affects Pro Cloud Server: earlier than 6.0.165.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-22\", \"description\": \"CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"CWE-20 Improper Input Validation\"}]}], \"providerMetadata\": {\"orgId\": \"db4dfee8-a97e-4877-bfae-eba6d14a2166\", \"shortName\": \"NCSC-FI\", \"dateUpdated\": \"2025-05-09T05:12:59.487Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2025-4377\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-09T13:22:16.817Z\", \"dateReserved\": \"2025-05-06T05:21:12.322Z\", \"assignerOrgId\": \"db4dfee8-a97e-4877-bfae-eba6d14a2166\", \"datePublished\": \"2025-05-09T05:12:59.487Z\", \"assignerShortName\": \"NCSC-FI\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…