PT-2025-18958 · Inedo · Inedo Proget

Published 2025-04-26 · Updated 2025-05-08 · CVE-2025-47244

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Inedo ProGet versions 2024.22 and earlier

Description Inedo ProGet allows remote attackers to reach restricted functionality through the C# reflection layer. This can be demonstrated by causing a denial of service, such as when an attacker executes a loop calling RestartWeb, or obtaining potentially sensitive information. Exploitation can occur if Anonymous access is enabled, or if there is a successful CSRF attack.

Recommendations For Inedo ProGet versions 2024.22 and earlier, consider disabling Anonymous access and ensure protection against CSRF attacks to minimize the risk of exploitation. As a temporary workaround, consider restricting access to the C# reflection layer until a patch is available.

Fix

DoS

RCE

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

BDU:2025-06416

CVE-2025-47244

Affected Products

Inedo Proget

References · 12

• https://bdu.fstec.ru/vul/2025-06416 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-47244 · Security Note
• https://twitter.com/CVEnew/status/1918800311264612671 · Twitter Post
• https://twitter.com/cracbot/status/1920433585141469336 · Twitter Post
• https://my.inedo.com/downloads/installers?product=ProGet · Note
• https://t.me/cvetracker/23003 · Telegram Post
• https://t.me/cvenotify/120742 · Telegram Post
• https://docs.inedo.com/docs/proget/installation/installation-guide · Note
• https://t.me/cvedetector/24413 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1918813209814810834 · Twitter Post
• https://forums.inedo.com · Note
• https://seclists.org/fulldisclosure/2025/Apr/30 · Note