2 lines
3.3 KiB
JSON
2 lines
3.3 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Proget","vendor":"Proget","versions":[{"lessThan":"2.17.5","status":"affected","version":"0","versionType":"semver"}]}],"source":"cvd@cert.pl"}],"cveTags":[],"descriptions":[{"lang":"en","value":"In Proget MDM, a low-privileged user can retrieve passwords for managed devices and subsequently use functionalities restricted by the MDM (Mobile Device Management). For it to happen, they must know the UUIDs of targetted devices, which might be obtained by exploiting CVE-2025-1415 or CVE-2025-1417.\n\nThis issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite)."},{"lang":"es","value":"En Proget MDM, un usuario con pocos privilegios puede recuperar contraseñas de dispositivos administrados y, posteriormente, usar funcionalidades restringidas por la MDM (Administración de Dispositivos Móviles). Para ello, debe conocer los UUID de los dispositivos objetivo, que podrían obtenerse mediante la explotación de CVE-2025-1415 o CVE-2025-1417. Este problema se ha corregido en la versión 2.17.5 de Konsola Proget (componente servidor de la suite MDM)."}],"id":"CVE-2025-1416","lastModified":"2026-06-17T08:39:05.847","metrics":{"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","availabilityRequirement":"NOT_DEFINED","baseScore":7.0,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"cvd@cert.pl","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2025-1416","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2025-05-21T13:31:18.566757Z","version":"2.0.3"}}]},"published":"2025-05-21T13:16:00.700","references":[{"source":"cvd@cert.pl","url":"https://cert.pl/en/posts/2025/05/CVE-2025-1415"},{"source":"cvd@cert.pl","url":"https://proget.pl/en/mobile-device-management/"}],"sourceIdentifier":"cvd@cert.pl","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-863"}],"source":"cvd@cert.pl","type":"Secondary"}]}
|