Proget MDM Backup Information Disclosure Vulnerability

A vulnerability exists in Proget MDM versions prior to 2.17.5, allowing low-privileged users to access sensitive information from backups of all managed devices. This information includes user IDs, email addresses, first and last names, and device UUIDs. The UUIDs can be exploited to retrieve passwords for managed devices, enabling access to functionalities restricted by the MDM. Successful exploitation of this vulnerability requires knowledge of the UUID of the targeted backup, which cannot be brute-forced.

Impact

Exploitation of this vulnerability could lead to unauthorized access to personal information and device UUIDs, which could be used to exploit other vulnerabilities in the Proget MDM suite.

Remediation

Users can update to Proget MDM version 2.17.5 or later to address this vulnerability.