{"id":"CVE-2025-4377","state":"PUBLISHED","title":"Path traversal vulnerability in Sparx Pro Cloud Server WebEA webconfig in logview.php","description":"Improper Limitation of a Pathname caused a Path Traversal vulnerability in Sparx Systems Pro Cloud Server.\n\nThis vulnerability is present in logview.php and it allows reading arbitrary files on the filesystem. \n\nLogview is accessible on Pro Cloud Server Configuration interface. \n\n\nThis issue affects Pro Cloud Server: earlier than 6.0.165.","publishedAt":"2025-05-09T05:12:59.487Z","updatedAt":"2025-05-09T13:22:16.817Z","severity":{"score":8.3,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:N/SA:N","source":"NCSC-FI"},"assigner":"NCSC-FI","products":["Sparx Systems Pro Cloud Server"],"affected":[{"vendor":"Sparx Systems","product":"Pro Cloud Server","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"6.0.163","versionType":"PCS"},{"version":"6.0.165","status":"unaffected","versionType":"PCS"}],"collectionURL":"https://sparxsystems.com/products/procloudserver/","platforms":["Windows"],"programFiles":["logview.php"]}],"references":["https://sparxsystems.com/products/procloudserver/6.1/"],"weaknesses":["CWE-22","CWE-20"],"ingestedAt":"2026-10-29T20:09:23.771Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/4xxx/CVE-2025-4377.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-4377","state":"PUBLISHED","datePublished":"2025-05-09T05:12:59.487Z","dateUpdated":"2025-05-09T13:22:16.817Z","assignerShortName":"NCSC-FI","assignerOrgId":"db4dfee8-a97e-4877-bfae-eba6d14a2166","dateReserved":"2025-05-06T05:21:12.322Z"},"containers":{"cna":{"title":"Path traversal vulnerability in Sparx Pro Cloud Server WebEA webconfig in logview.php","descriptions":[{"lang":"en","value":"Improper Limitation of a Pathname caused a Path Traversal vulnerability in Sparx Systems Pro Cloud Server.\n\nThis vulnerability is present in logview.php and it allows reading arbitrary files on the filesystem. \n\nLogview is accessible on Pro Cloud Server Configuration interface. \n\n\nThis issue affects Pro Cloud Server: earlier than 6.0.165."}],"affected":[{"vendor":"Sparx Systems","product":"Pro Cloud Server","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"6.0.163","versionType":"PCS"},{"version":"6.0.165","status":"unaffected","versionType":"PCS"}],"collectionURL":"https://sparxsystems.com/products/procloudserver/","platforms":["Windows"],"programFiles":["logview.php"]}],"references":[{"url":"https://sparxsystems.com/products/procloudserver/6.1/"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.3,"baseSeverity":"HIGH","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"LOW","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-20","description":"CWE-20 Improper Input Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"NCSC-FI","orgId":"db4dfee8-a97e-4877-bfae-eba6d14a2166","dateUpdated":"2025-05-09T05:12:59.487Z"},"credits":[{"lang":"en","type":"finder","value":"Santeri Siirilä"},{"lang":"en","type":"finder","value":"Mikko Korpi"}],"datePublic":"2025-05-05T06:00:00.000Z","impacts":[{"capecId":"CAPEC-126","descriptions":[{"lang":"en","value":"CAPEC-126: Path Traversal"}]},{"capecId":"CAPEC-139","descriptions":[{"lang":"en","value":"CAPEC-139: Relative Path Traversal"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-05-09T13:22:04.482705Z","id":"CVE-2025-4377","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-05-09T13:22:16.817Z"}}]}}}