Proget MDM Multiple Authorization Bypass and XSS Vulnerabilities (CVE-2025-1415 to 1421)

Critical Vulnerability Information Vulnerability Overview Release Date: May 21, 2023 Report Source: Reported to CERT Polska Affected Versions: All versions below 2.17.5 Vulnerability Details CVE-2025-1415 Type: Incorrect Authorization (CWE-863) Description: Low-privileged users can obtain information about tasks executed on Proget MDM and detailed information about managed devices, such as UUIDs. This information can be used to exploit CVE-2025-1416. CVE-2025-1416 Type: Incorrect Authorization (CWE-863) Description: In Proget MDM, low-privileged users can retrieve passwords for managed devices and subsequently use the feature to restore devices to factory settings. To do this, they must know the target device's UUIDs, which may be obtained by exploiting CVE-2025-1415. CVE-2025-1417 Type: Incorrect Authorization (CWE-863) Description: In Proget MDM, low-privileged users can access change information from backups of all devices managed by MDM, including user ID, email address, first name, last name, and device UUIDs. The latter information can be used to exploit CVE-2025-1416. CVE-2025-1418 Type: Incorrect Authorization (CWE-863) Description: Low-privileged users can access information about configuration profiles created in Proget MDM, including details about allowed/disallowed features. Configuration profiles do not display any sensitive information (including connected devices). CVE-2025-1419 Type: Improper Neutralization of Input During Web Page Generation (XSS or Cross-Site Scripting) (CWE-79) Description: The comment section input in Konsola Proget is not properly neutralized, allowing high-privileged users to perform stored cross-site scripting attacks. CVE-2025-1420 Type: Improper Neutralization of Input During Web Page Generation (XSS or Cross-Site Scripting) (CWE-79) Description: The input field in Konsola Proget is not properly neutralized, allowing high-privileged users to perform stored cross-site scripting attacks. CVE-2025-1421 Type: Improper Neutralization of Formula Elements in CSV Files (CWE-1236) Description: Data provided in requests is stored in the database when activating a new device. Other high-privileged users may download this data as a CSV file and open it (e.g., in Microsoft Excel), enabling attackers to remotely access users' PCs. Fix Fixed Version: Proget version 2.17.5 Acknowledgments Reporter: Marcin Węglowski (AFINE)

Goal Reached Thanks to every supporter — we hit 100%!

Proget MDM Multiple Authorization Bypass and XSS Vulnerabilities (CVE-2025-1415 to 1421)