« Volver al listado

CVE-2025-15621

Estado: AnalizadaMedia (5.7)—

Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 credentials during OpenID authentication

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Sparxsystems — Enterprise Architect

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-15621",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-15621",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-04-16T12:51:32.874380Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 0.8
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "db4dfee8-a97e-4877-bfae-eba6d14a2166",
        "cvssData": {
          "Safety": "PRESENT",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 5.7,
          "Automatable": "YES",
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "valueDensity": "CONCENTRATED",
          "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:C/RE:M/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "PASSIVE",
          "attackComplexity": "HIGH",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "MODERATE",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "db4dfee8-a97e-4877-bfae-eba6d14a2166",
      "affectedData": [
        {
          "vendor": "Sparx Systems Pty Ltd.",
          "product": "Sparx Enterprise Architect",
          "versions": [
            {
              "status": "affected",
              "version": "16.1.1627"
            },
            {
              "status": "unaffected",
              "version": "17.1.1714"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2026-04-16T13:16:43.423",
  "references": [
    {
      "url": "https://sparxsystems.com/products/ea/17.1/history.html",
      "tags": [
        "Release Notes"
      ],
      "source": "db4dfee8-a97e-4877-bfae-eba6d14a2166"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "db4dfee8-a97e-4877-bfae-eba6d14a2166",
      "description": [
        {
          "lang": "en",
          "value": "CWE-522"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 credentials during OpenID authentication"
    },
    {
      "lang": "es",
      "value": "Credenciales insuficientemente protegidas en Sparx Systems Pty Ltd. Sparx Enterprise Architect. El cliente no verifica el receptor de las credenciales OAuth2 durante la autenticación OpenID"
    }
  ],
  "lastModified": "2026-09-30T22:10:00.273",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sparxsystems:enterprise_architect:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1D756634-6D4C-4D63-862F-BB7874EBBC83",
              "versionEndExcluding": "17.1.1714",
              "versionStartIncluding": "16.1.1627"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "db4dfee8-a97e-4877-bfae-eba6d14a2166"
}