Description (CNA)
The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or authorize API requests, creating an IDOR (Insecure Direct Object Reference) vulnerability.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| 1Byte / Copy9 | affected All |
| 1Byte / FoneTracker | affected All |
| 1Byte / iSpyoo | affected All |
| 1Byte / GuestSpy | affected All |
| 1Byte / TheSpyApp | affected All |
| 1Byte / ExactSpy | affected All |
| 1Byte / SecondClone | affected All |
| 1Byte / The Truth Spy | affected All |
| 1Byte / MxSpy | affected All |
CWE
CWE-284
References
- https://www.kb.cert.org/vuls/id/229438
- https://cwe.mitre.org/data/definitions/284.html
- https://techcrunch.com/2022/02/22/stalkerware-network-spilling-data/
- https://kb.cert.org/vuls/id/229438
ADP enrichment
No English description supplied.