CVE-2025-15624

Upgrade immediately to Sparx Pro Cloud Server version 6.1 or later, which addresses this vulnerability per vendor release history at https://sparxsystems.com/products/procloudserver/6.1/history.html. Post-upgrade, force password resets for all local user accounts created during the vulnerable period, as plaintext credentials may have been logged, backed up, or cached. If immediate patching is not feasible, implement compensating controls: restrict network access to backend database and configuration storage using firewall rules limited to application server IP addresses only (eliminates remote attack vector but does not protect against local threats or compromised app servers); enable database-level encryption at rest with key management separated from application servers (adds cryptographic barrier but keys may be accessible to compromised systems); implement file integrity monitoring on password storage locations with alerting on unauthorized access (detection only, does not prevent exposure); and disable local account creation by enforcing pure federated authentication without local fallback (may break disaster recovery access - document break-glass procedures). Note that compensating controls do not eliminate the plaintext storage vulnerability and should only be temporary measures pending upgrade.