{"id":"CVE-2025-47244","aliases":["EUVD-2025-13348","GHSA-9vqf-p3v5-qmh2"],"status":"published","title":"Inedo ProGet through 2024.22 allows remote attackers to reach restricted functionality through...","description":"Inedo ProGet through 2024.22 allows remote attackers to reach restricted functionality through the C# reflection layer, as demonstrated by causing a denial of service (when an attacker executes a loop calling RestartWeb) or obtaining potentially sensitive information. Exploitation can occur if Anonymous access is enabled, or if there is a successful CSRF attack.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00477,"percentile":0.41552,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-288"],"published":"2025-05-03T00:00:00Z","modified":"2026-06-17T09:27:37Z","products":[{"vendor":"inedo","product":"proget"},{"vendor":"proget","product":"proget"}],"references":[{"url":"https://seclists.org/fulldisclosure/2025/Apr/30"},{"url":"https://forums.inedo.com"},{"url":"https://docs.inedo.com/docs/proget/installation/installation-guide"},{"url":"https://my.inedo.com/downloads/installers?product=ProGet"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47244"},{"url":"https://github.com/advisories/GHSA-9vqf-p3v5-qmh2"}],"sources":{"cve":[{"id":"CVE-2025-47244","description":"Inedo ProGet through 2024.22 allows remote attackers to reach restricted functionality through the C# reflection layer, as demonstrated by causing a denial of service (when an attacker executes a loop calling RestartWeb) or obtaining potentially sensitive information. Exploitation can occur if Anonymous access is enabled, or if there is a successful CSRF attack.","status":"published","published":"2025-05-03T00:00:00Z","modified":"2025-05-05T14:21:24.798Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:32:25.982948Z"}],"euvd":[{"id":"EUVD-2025-13348","description":"Inedo ProGet through 2024.22 allows remote attackers to reach restricted functionality through the C# reflection layer, as demonstrated by causing a denial of service (when an attacker executes a loop calling RestartWeb) or obtaining potentially sensitive information. Exploitation can occur if Anonymous access is enabled, or if there is a successful CSRF attack.","status":"published","published":"2025-05-03T00:00:00Z","modified":"2025-05-05T14:21:24Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T20:32:57.470964Z"}],"ghsa":[{"id":"GHSA-9vqf-p3v5-qmh2","title":"Inedo ProGet through 2024.22 allows remote attackers to reach restricted functionality through...","description":"Inedo ProGet through 2024.22 allows remote attackers to reach restricted functionality through the C# reflection layer, as demonstrated by causing a denial of service (when an attacker executes a loop calling RestartWeb) or obtaining potentially sensitive information. Exploitation can occur if Anonymous access is enabled, or if there is a successful CSRF attack.","status":"published","published":"2025-05-04T00:30:36Z","modified":"2025-05-04T00:30:41Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T15:02:06.913728Z"}],"nvd":[{"id":"CVE-2025-47244","description":"Inedo ProGet through 2024.22 allows remote attackers to reach restricted functionality through the C# reflection layer, as demonstrated by causing a denial of service (when an attacker executes a loop calling RestartWeb) or obtaining potentially sensitive information. Exploitation can occur if Anonymous access is enabled, or if there is a successful CSRF attack.","status":"published","published":"2025-05-03T23:15:48.15Z","modified":"2026-06-17T09:27:37.933Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-288"],"updated_at":"2026-11-02T14:11:04.33372Z"}]}}