Vulnerability · Published May 9, 2025 · Assigned by NCSC-FI
CVE-2025-4375Cross-Site Request Forgery vulnerability in Pro Cloud Server's WebEA
Medium 6.9
In plain English
A medium-severity cross-site request forgery in Pro Cloud Server from Sparx Systems. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).
Official description
Cross-Site Request Forgery (CSRF) vulnerability in Sparx Systems Pro Cloud Server allows Cross-Site Request Forgery to perform Session Hijacking. Cross-Site Request Forgery is present at the whole application but it can be used to change the Pro Cloud Server Configuration password. This issue affects Pro Cloud Server: earlier than 6.0.165.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Sparx Systems | Pro Cloud Server | 0 – through 6.0.14 |
Weakness: CWE-352 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N