Information disclosure in Proget MDM
Key facts
- Attack vector
- Adjacent network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-863.
Summary
A low-privileged user is able to obtain information about tasks executed on devices controlled by Proget MDM (Mobile Device Management), as well as details of the devices like their UUIDs needed for exploitation of CVE-2025-1416. In order to perform the attack, one has to know a task_id, but since it's a low integer and there is no limit of requests an attacker can perform to a vulnerable endpoint, the task_id might be simply brute forced. This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA Proget (Proget) Fixed in 2.17.5
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Proget 2.17.5
7 records Highest priority Priority LOW 7 LOW
Other records, highest priority first
- TI-2025-01218 Password disclosure in Proget MDMPriority LOW 32
- TI-2025-01220 Information disclosure in Proget MDMPriority LOW 23
- TI-2025-01219 Information disclosure in Proget MDMPriority LOW 21
Timeline
- 2026-10-02 Threatist record created from CVE-2025-1415
- 2026-10-03 Alias added: GHSA-rfvm-7wp6-hchg
References
More Proget vulnerabilities
- TI-2025-01218 Password disclosure in Proget MDM CVSS 4.0HIGH 7.0
- TI-2025-01220 Information disclosure in Proget MDM CVSS 4.0MEDIUM 5.1
- TI-2025-01219 Information disclosure in Proget MDM CVSS 4.0MEDIUM 4.6
- TI-2025-01223 Formula injection in a CSV file in Proget MDM CVSS 4.0LOW 2.4
- TI-2025-01222 XSS in Proget MDM CVSS 4.0LOW 2.4
- TI-2025-01221 XSS in Proget MDM CVSS 4.0LOW 2.4
Sources
- CVE-2025-1415 · CVE Program
- CVE-2025-1415 · NVD
- FIRST EPSS
- GHSA-rfvm-7wp6-hchg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences