7.5

CVE-2022-0732

Medienbericht
The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or authorize API requests, creating an IDOR (Insecure Direct Object Reference) vulnerability.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
1byte ≫ Copy9 Version -
1byte ≫ Exactspy Version -
1byte ≫ Fonetracker Version -
1byte ≫ Guestspy Version -
1byte ≫ Ispyoo Version -
1byte ≫ Mxspy Version -
1byte ≫ Secondclone Version -
1byte ≫ The Truth Spy Version -
1byte ≫ Thespyapp Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.51% 0.83
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CWE-639 Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

https://cwe.mitre.org/data/definitions/284.html
Not Applicable
https://kb.cert.org/vuls/id/229438
Third Party Advisory
US Government Resource
https://techcrunch.com/2022/02/22/stalkerware-network-spilling-data/
Third Party Advisory
Press/Media Coverage
https://www.kb.cert.org/vuls/id/229438
Third Party Advisory
US Government Resource