CVE-2025-1416highCWE-863

CVE-2025-1416: high-severity vulnerability in Proget

Password disclosure in Proget MDM

Published

Follow this CVE+ Monitor Proget

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7epss 0.2%
In Proget MDM, a low-privileged user can retrieve passwords for managed devices and subsequently use functionalities restricted by the MDM (Mobile Device Management). For it to happen, they must know the UUIDs of targetted devices, which might be obtained by exploiting CVE-2025-1415 or CVE-2025-1417. This issue has been fixed in 2.17.5 version of Konsola Proget (server part of the MDM suite).
CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N
Affected products
Proget · Proget
Related CVEs — Proget

In the same product, most dangerous first.

CVE-2025-1421LOWFormula injection in a CSV file in Proget MDMEPSS 0.3%CVE-2025-1420LOWXSS in Proget MDMEPSS 0.2%CVE-2025-1419LOWXSS in Proget MDMEPSS 0.2%CVE-2025-1415MEDIUMInformation disclosure in Proget MDMEPSS 0.2%CVE-2025-1418MEDIUMInformation disclosure in Proget MDMEPSS 0.2%CVE-2025-1417MEDIUMInformation disclosure in Proget MDMEPSS 0.2%