CVE-2025-4377CWE-20CWE-22

Path traversal vulnerability in Sparx Pro Cloud Server WebEA webconfig in logview.php

High · published May 9, 2025

CVSS v4.0
8.3
EPSS
1%
Percentile
54.8
In the wild
Unconfirmed
What it is

Improper Limitation of a Pathname caused a Path Traversal vulnerability in Sparx Systems Pro Cloud Server.

This vulnerability is present in logview.php and it allows reading arbitrary files on the filesystem.

Logview is accessible on Pro Cloud Server Configuration interface.

This issue affects Pro Cloud Server: earlier than 6.0.165.

The record
Technical detail
CVSS v4.0
8.3 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:N/SA:N
EPSS
0.00760 · 54.8th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-05-09T05:12Z
EPSS history
Timeline
  • 09 MAY 05:12Z
    Path traversal vulnerability in Sparx Pro Cloud Server WebEA webconfig in logview.php
    cvelistv5