Proget MDM Incorrect Authorization Vulnerability Allowing Unauthorized Access to Profile Information

An incorrect authorization vulnerability has been identified in Proget MDM, specifically in the server component of the Proget suite. This vulnerability allows low-privileged users to access information about profiles created within the MDM, including details on permitted and restricted functions. However, the profiles do not contain sensitive information or details about their application on connected devices. The vulnerability affects all versions of Proget prior to 2.17.5.

Impact

Exploitation of this vulnerability could lead to unauthorized access to profile information within Proget MDM, allowing low-privileged users to gain insights into managed functions and policies, potentially facilitating further exploitation of the MDM system.

Remediation

Users can upgrade to Proget version 2.17.5 or later to address this vulnerability.