7.5

CVE-2022-0732

Media report

The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or authorize API requests, creating an IDOR (Insecure Direct Object Reference) vulnerability.

Data is provided by the National Vulnerability Database (NVD)
1byte ≫ Copy9 Version-
1byte ≫ Exactspy Version-
1byte ≫ Fonetracker Version-
1byte ≫ Guestspy Version-
1byte ≫ Ispyoo Version-
1byte ≫ Mxspy Version-
1byte ≫ Secondclone Version-
1byte ≫ The Truth Spy Version-
1byte ≫ Thespyapp Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.68% 0.706
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CWE-639 Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

https://kb.cert.org/vuls/id/229438
Third Party Advisory
US Government Resource
https://www.kb.cert.org/vuls/id/229438
Third Party Advisory
US Government Resource