PT-2025-22349 · Unknown · Proget Mdm

Marcin Węgłowski · Published 2025-05-21 · Updated 2025-05-21 · CVE-2025-1417

Positive Technologies (AI Summary)

CVSS v4.0

4.6

Medium

Base vector

AV:A/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Proget MDM versions prior to 2.17.5

Description A low-privileged user can access information about changes contained in backups of all devices managed by the MDM, including user ids, email addresses, first names, last names, and device UUIDs. The device UUID can be used for further exploitation. Successful exploitation requires the UUID of a targeted backup, which cannot be brute forced.

Recommendations For versions prior to 2.17.5, update to version 2.17.5 or later to resolve the issue. As a temporary workaround, consider restricting access to backup information to minimize the risk of exploitation.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-1417

Affected Products

Proget Mdm

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-1417 · Security Note
• https://proget.pl/en/mobile-device-management · Note
• https://twitter.com/CVEnew/status/1925185823017680926 · Twitter Post
• https://cert.pl/en/posts/2025/05/CVE-2025-1415 · Note