CVE-2022-0732

The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or authorize API requests, creating an IDOR (Insecure Direct Object Reference) vulnerability.

Score

CVSS 3.1 7.5 High

Status

Modified - cret@cert.org

Published

2022-02-24

Last modified

2024-09-16

Weaknesses

CWE-284, CWE-639

Affected products

• Copy9 (1byte)
• Exactspy (1byte)
• Fonetracker (1byte)
• Guestspy (1byte)
• Ispyoo (1byte)
• Mxspy (1byte)
• Secondclone (1byte)
• The Truth Spy (1byte)
• Thespyapp (1byte)

References

• https://cwe.mitre.org/data/definitions/284.html
• https://kb.cert.org/vuls/id/229438
• https://techcrunch.com/2022/02/22/stalkerware-network-spilling-data/
• https://www.kb.cert.org/vuls/id/229438