Vulnerability · Published May 21, 2025 · Assigned by CERT-PL

CVE-2025-1415Information disclosure in Proget MDM

Medium 5.1

In plain English

A medium-severity incorrect authorization in Proget from Proget. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)0.2%top 88.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A low-privileged user is able to obtain information about tasks executed on devices controlled by Proget MDM (Mobile Device Management), as well as details of the devices like their UUIDs needed for exploitation of CVE-2025-1416. In order to perform the attack, one has to know a task_id, but since it's a low integer and there is no limit of requests an attacker can perform to a vulnerable endpoint, the task_id might be simply brute forced. This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).

Affected products (as reported)

Vendor	Product	Versions
Proget	Proget	0 – before 2.17.5

Weakness: CWE-863 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

References

https://cert.pl/en/posts/2025/05/CVE-2025-1415 third-party-advisory
https://proget.pl/en/mobile-device-management/ product