high7.5
CVE-2022-0732
The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or authorize API requests, creating an IDOR (I…
Impact
The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or authorize API requests, creating an IDOR (Insecure Direct Object Reference) vulnerability.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| 1byte | Copy9 | All versions |
| 1byte | Exactspy | All versions |
| 1byte | Fonetracker | All versions |
| 1byte | Guestspy | All versions |
| 1byte | Ispyoo | All versions |
| 1byte | Mxspy | All versions |
| 1byte | Secondclone | All versions |
| 1byte | The Truth Spy | All versions |
| 1byte | Thespyapp | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- https://cwe.mitre.org/data/definitions/284.html
- https://kb.cert.org/vuls/id/229438
- https://techcrunch.com/2022/02/22/stalkerware-network-spilling-data/
- https://www.kb.cert.org/vuls/id/229438
- https://cwe.mitre.org/data/definitions/284.html
- https://kb.cert.org/vuls/id/229438
- https://techcrunch.com/2022/02/22/stalkerware-network-spilling-data/
- https://www.kb.cert.org/vuls/id/229438