Vulnerability · Published May 9, 2025 · Assigned by NCSC-FI
CVE-2025-4377Path traversal vulnerability in Sparx Pro Cloud Server WebEA webconfig in logview.php
High 8.3
In plain English
A high-severity path traversal in Pro Cloud Server from Sparx Systems. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities).
Official description
Improper Limitation of a Pathname caused a Path Traversal vulnerability in Sparx Systems Pro Cloud Server. This vulnerability is present in logview.php and it allows reading arbitrary files on the filesystem. Logview is accessible on Pro Cloud Server Configuration interface. This issue affects Pro Cloud Server: earlier than 6.0.165.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Sparx Systems | Pro Cloud Server | 0 – through 6.0.163 |
Weakness: CWE-22, CWE-20 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:N/SA:N