CVE-2022-0732

Опубликовано: 24 фев. 2022

Источник: nvd

CVSS3: 7.5

CVSS2: 5

EPSS Низкий

Описание

The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or authorize API requests, creating an IDOR (Insecure Direct Object Reference) vulnerability.

Ссылки

https://cwe.mitre.org/data/definitions/284.html
Not Applicable
https://kb.cert.org/vuls/id/229438
Third Party Advisory
US Government Resource
https://techcrunch.com/2022/02/22/stalkerware-network-spilling-data/
Press/Media Coverage
Third Party Advisory
https://www.kb.cert.org/vuls/id/229438
Third Party Advisory
US Government Resource
https://cwe.mitre.org/data/definitions/284.html
Not Applicable
https://kb.cert.org/vuls/id/229438
Third Party Advisory
US Government Resource
https://techcrunch.com/2022/02/22/stalkerware-network-spilling-data/
Press/Media Coverage
Third Party Advisory
https://www.kb.cert.org/vuls/id/229438
Third Party Advisory
US Government Resource

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:1byte:copy9:-:*:*:*:*:*:*:*

cpe:2.3:a:1byte:exactspy:-:*:*:*:*:*:*:*

cpe:2.3:a:1byte:fonetracker:-:*:*:*:*:*:*:*

cpe:2.3:a:1byte:guestspy:-:*:*:*:*:*:*:*

cpe:2.3:a:1byte:ispyoo:-:*:*:*:*:*:*:*

cpe:2.3:a:1byte:mxspy:-:*:*:*:*:*:*:*

cpe:2.3:a:1byte:secondclone:-:*:*:*:*:*:*:*

cpe:2.3:a:1byte:the_truth_spy:-:*:*:*:*:*:*:*

cpe:2.3:a:1byte:thespyapp:-:*:*:*:*:*:*:*

EPSS

Процентиль: 65%

0.00498

Низкий

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-284

CWE-639

Связанные уязвимости

GHSA-j85g-452w-9q39