Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2025-0836

XProtect MIP API Missing Authorization

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Milestone

Description

Missing Authorization vulnerability in Milestone Systems XProtect VMS allows users with read-only access to Management Server to have full read/write access to MIP Webhooks API.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Milestone Systems XProtect VMS

Default version status: unaffected

  • 23.1 to < 23.1.157.1.1470affected
  • 23.2 to < 23.2.21.1.398affected
  • 23.3 to < 23.3.72.1.466affected
  • 24.1 to < 24.1.12292.2279affected
  • 24.2 to < 24.2.14561.2270affected
  • 25.1 to < 25.1.15990.2272affected

References