CVE-2025-4377 HIGH

CVE-2025-4377: Path traversal vulnerability in Sparx Pro Cloud Server WebEA webconfig in logview.php

Vendor Sparx Systems
Product Pro Cloud Server
Weakness CWE-22 · Path traversal
Published May 9, 2025
Last update May 9, 2025
View on NVD All CVEs

CVSS base score

8.3/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:N/SA:N

What the vulnerability does

01Description

Improper Limitation of a Pathname caused a Path Traversal vulnerability in Sparx Systems Pro Cloud Server. This vulnerability is present in logview.php and it allows reading arbitrary files on the filesystem.  Logview is accessible on Pro Cloud Server Configuration interface. This issue affects Pro Cloud Server: earlier than 6.0.165.

Key dates

02Disclosure timeline

May 9, 2025 CVE published
May 9, 2025 Record updated